Chapter 26 — Digital forensics and malware analysis: architecture alternatives
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Alternative 1: single workstation"]
N2["26.2 Alternative 2: client–server on the examination"]
N3["26.3 Alternative 3: commercial case management"]
N4["26.4 Evaluation"]
N5["26.5 Security comparison"]
N6["26.6 Validation cost"]
N7["26.7 Exit plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Alternative 1: single workstation"]
N2["26.2 Alternative 2: client–server on the examination"]
N3["26.3 Alternative 3: commercial case management"]
N4["26.4 Evaluation"]
N5["26.5 Security comparison"]
N6["26.6 Validation cost"]
N7["26.7 Exit plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Alternative 1: single workstation]
|
v
[26.2 Alternative 2: client–server on the examination]
|
v
[26.3 Alternative 3: commercial case management]
|
v
[26.4 Evaluation]
|
v
[26.5 Security comparison]
|
v
[26.6 Validation cost]
|
v
[26.7 Exit plan]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) compare architectures for an evidence system; (2) evaluate them against requirements; (3) consider security and validation cost; (4) choose and justify.
26.1 Alternative 1: single workstation
EvidenceDesk runs on one offline machine in the examination zone. Simple and easy to validate; a single point of failure.
Validation is simple because there is one machine, one installation and no network code. Backups depend on someone copying files to removable media on schedule. If the workstation fails, registration stops until it is repaired or restored. With six examiners, there would also be queues at the one machine during busy intake periods, which the timing data from the studio makes concrete.
26.2 Alternative 2: client–server on the examination LAN
A small server holds records; examiner workstations connect. Supports concurrent users and central backups; more components to secure and test.
The server holds the authoritative records and runs the daily chain check, while workstations run a thin client that sends requests and shows results. Concurrent use needs locking, so two examiners cannot create conflicting custody events for one item at the same moment. Central backups run nightly from the server. Each extra component, such as the network service and authentication, adds tests and attack surface.
26.3 Alternative 3: commercial case management
Buy an existing product. Features and support; less control over code, validation depends on vendor evidence, and licensing costs.
Vendor products often include reporting, dashboards and integrations that would take years to build in-house. Validation then depends on the vendor's test evidence and on Northfield's own acceptance testing, because the code cannot be inspected. Licensing costs recur annually, and moving away later depends on whether the product exports complete records in an open format. Priya asks two vendors for their validation documentation and an example export. One provides both; the other offers only a summary sheet.
26.4 Evaluation
Priya scores each against FR1–FR5 and NFR1–NFR4, plus security and validation cost. Alternative 2 meets all Musts and supports Northfield's six examiners; Alternative 1 fails concurrency; Alternative 3 scores well but cannot satisfy NFR2 (auditable code).
Priya's scoring sheet gives weights agreed with the lab manager before scoring starts: Musts are pass or fail, Shoulds score from zero to three, and security and validation cost are each scored separately. Agreeing weights first stops the sheet from being adjusted to favour a preferred answer. The completed sheet goes into the design record with the raw scores, not just the totals.
26.5 Security comparison
Alternative 2 adds a network service. Mitigations: examination LAN only, authenticated access, logged administration, no internet route.
Authenticated access means individual accounts, not a shared lab login, so every custody event names a person. Administration happens only from a designated console and is logged to a store administrators cannot edit. With no internet route, remote attackers would first need a foothold in the examination zone, which already has its own controls. The server runs only the EvidenceDesk service and a time client, and its firewall rules list which workstation addresses may connect. A port scan from an unlisted machine during testing is expected to find nothing.
26.6 Validation cost
Each component that touches records needs tests. Alternative 2 adds server and client tests but they reuse the same core library.
The shared core library holds record creation, chain hashing and state transitions, so most tests target it once. Client tests check that the interface sends correct requests and displays refusals clearly, and server tests check locking, authentication and backups. Priya estimates validation effort in days for each alternative, and the core library makes Alternative 2's extra cost modest. Her estimates are twelve days for Alternative 1 and fifteen for Alternative 2.
26.7 Exit plan
Records are plain JSON lines, so Northfield can migrate to another system later without losing history.
An exit plan states how records would move to a successor system: export the JSON-lines files, verify the hash chains and map entity fields to the new schema. Priya tests this by importing a synthetic export into a simple spreadsheet and confirming that every custody event survives. Labs that ignore exit plans can find their history locked inside a product they no longer want.
Hybrid options
Priya also considers a hybrid: commercial case management for scheduling, with EvidenceDesk handling integrity records. It adds an interface to maintain and splits records across two systems, complicating disclosure. She records it as considered and rejected, with those reasons, so future reviewers know it was not overlooked when the lab next revisits its architecture.
Worked example
The lab manager favours buying a product. Priya presents the scoring table and notes that the vendor would not share source or test evidence. They agree on Alternative 2, with a review in two years.
Synthetic case. The scoring and vendor are invented.
Errors and limits
Scoring weights reflect priorities; show how a different weighting would change the choice.
Exercises
- EX076 — Concurrency. Why does Alternative 1 fail? Rubric: 3 = no concurrent users across six examiners; 2 = partial; 1 = cost; 0 = none.
- EX077 — Vendor gap. Which requirement did Alternative 3 not satisfy, and why? Rubric: 3 = NFR2; source not auditable; 2 = partial; 1 = wrong; 0 = none.
- EX078 — Exit plan. Why do plain JSON records support an exit plan? Rubric: 3 = readable, migratable without vendor lock; 2 = partial; 1 = smaller; 0 = none.
Synthesis
Compare architectures openly against requirements, security and validation cost, and keep an exit path.
Continue studying — chapter 26 of 50
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →