Chapter 22 — Digital forensics and malware analysis: system and data models
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Entities"]
N2["22.2 State model"]
N3["22.3 Derived evidence"]
N4["22.4 Storage format"]
N5["22.5 Time"]
N6["22.6 Identifiers"]
N7["22.7 Walking the model"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Entities"]
N2["22.2 State model"]
N3["22.3 Derived evidence"]
N4["22.4 Storage format"]
N5["22.5 Time"]
N6["22.6 Identifiers"]
N7["22.7 Walking the model"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Entities]
|
v
[22.2 State model]
|
v
[22.3 Derived evidence]
|
v
[22.4 Storage format]
|
v
[22.5 Time]
|
v
[22.6 Identifiers]
|
v
[22.7 Walking the model]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) model evidence entities and relationships; (2) model state changes of an item; (3) choose storage formats; (4) check models against real workflows.
22.1 Entities
Case, Item, Acquisition, WorkingCopy, CustodyEvent, Person. An Item belongs to a Case; an Acquisition belongs to an Item; WorkingCopies derive from an Acquisition; CustodyEvents record who held an Item when.
Person appears separately so that examiners, seizing officers and couriers are recorded once and referred to by ID, which avoids spelling variants of the same name across records. A WorkingCopy has its own identity because examiners may create several from one acquisition, and each must be traceable. Priya draws the entities as boxes with their keys, so the relationships can be checked at a glance.
22.2 State model
An Item moves through states: registered → in storage → acquired → verified → under examination → returned or retained. Transitions are allowed only in order, and each writes a CustodyEvent. A failed verification moves a copy to "rejected", never to examination.
Enforcing order means the system rejects a request to move an item from 'registered' straight to 'under examination', because acquisition and verification would be skipped. Returning an item requires a custody event naming who received it. A 'rejected' copy stays in the record with its failed digest, because evidence of a failure is part of the history and must not disappear.
22.3 Derived evidence
Exports and carved files derive from a WorkingCopy; the model records that lineage so any output traces back to the original acquisition.
Lineage is stored as a parent reference on each derived object: a carved image points to the working copy it came from, which points to its acquisition, which points to the item. A report exhibit can therefore be traced back through every step. If a working copy is later found to be corrupt, a query lists every output derived from it, so affected findings can be reviewed.
22.4 Storage format
Records are JSON lines in append-only files, one per entity type, with each line hashed into a chain. JSON is readable without special software, which helps disclosure.
Each line holds one record, plus the hash of the previous line and the hash of the record itself. Editing or deleting a line breaks the chain from that point on, which the daily check reports. Plain text means a defence expert can read the records with ordinary tools and recompute the chain independently, without trusting EvidenceDesk's own verifier.
22.5 Time
All times UTC, ISO 8601, with the source of the time recorded.
Recording the source matters because times come from different places: the server clock for events EvidenceDesk logs itself, the imaging tool's log for acquisition times, and an officer's statement for seizure time. A seizure time copied from a handwritten form carries different certainty from a server timestamp, and the record keeps that difference visible. ISO 8601 with an explicit Z suffix leaves no doubt that a value is UTC. Where a source gives only a date, the record stores the date alone instead of inventing midnight, so nobody later reads precision into it that never existed.
22.6 Identifiers
IDs are generated, never reused, and printed on labels attached to physical items.
Identifiers follow a pattern such as NRF-2026-00417, with a check digit so that a mistyped number is rejected rather than linked to the wrong item. They are never reused, even for an item registered in error, which is marked void instead. Labels carry the identifier as text and as a barcode, so both people and scanners can read them. A voided identifier still appears in searches, marked with the reason it was voided and who voided it.
22.7 Walking the model
Priya walks three past synthetic cases through the model with examiners, looking for steps it cannot represent.
One case reveals a gap: a phone handed back to its owner and seized again later. The original model assumed items leave only once. Priya adds a re-entry transition that creates a new custody event and keeps the earlier history, rather than registering the phone as a new item. Walking real sequences through the model finds problems that diagrams alone miss. Examiners sign off each walkthrough.
Validation of records
Each record is checked against a schema on write: required fields present, times parseable, digests the right length for their algorithm. Invalid records are rejected with a message, never stored half-complete. Priya tests the schema with deliberately broken records to confirm every rule triggers.
Worked example
The walk-through reveals that items sometimes go to an external lab for chip-off work and return. The model had no "external transfer" state. Priya adds it, with required fields for receiving organisation and seal numbers.
Synthetic case. The cases are invented.
Errors and limits
A model omits whatever it does not represent; walk-throughs reveal gaps, but not all.
Exercises
- EX064 — State rule. What happens to a working copy that fails verification? Rubric: 3 = moves to rejected; never to examination; 2 = partial; 1 = continues; 0 = none.
- EX065 — Lineage. Why record derivation of exports? Rubric: 3 = trace outputs to original acquisition; 2 = partial; 1 = storage; 0 = none.
- EX066 — Missing state. What gap did the walk-through find, and how was it fixed? Rubric: 3 = external transfer; new state with receiver, seals; 2 = one; 1 = vague; 0 = none.
Synthesis
A precise entity and state model makes custody and lineage explicit and testable.
Continue studying — chapter 22 of 50
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →