Chapter 33 — Digital forensics and malware analysis: safety and resilience
Lesson map
Lesson 33 published. Map, example, EX097.
flowchart TD
N0["Learning outcomes"]
N1["33.1 Fail-safe behaviour"]
N2["33.2 Ransomware resilience"]
N3["33.3 Graceful degradation"]
N4["33.4 Human safety"]
N5["33.5 Malware containment"]
N6["33.6 Continuity rehearsal"]
N7["33.7 Communication plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX097"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["33.1 Fail-safe behaviour"]
N2["33.2 Ransomware resilience"]
N3["33.3 Graceful degradation"]
N4["33.4 Human safety"]
N5["33.5 Malware containment"]
N6["33.6 Continuity rehearsal"]
N7["33.7 Communication plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX097"]
[Learning outcomes]
|
v
[33.1 Fail-safe behaviour]
|
v
[33.2 Ransomware resilience]
|
v
[33.3 Graceful degradation]
|
v
[33.4 Human safety]
|
v
[33.5 Malware containment]
|
v
[33.6 Continuity rehearsal]
|
v
[33.7 Communication plan]
|
v
[Worked example] --> [Exercise EX097]
Learning outcomes
You will (1) design EvidenceDesk to fail safely; (2) plan resilience against ransomware and outages; (3) protect people handling evidence; (4) rehearse continuity.
33.1 Fail-safe behaviour
When EvidenceDesk cannot verify a hash — a read error, missing file — it must fail closed: block examination and log the reason. Failing open (allowing examination) would let unverified evidence through silently.
The distinction comes from engineering more widely: a railway signal that loses power shows red, not green. For EvidenceDesk, the cost of failing closed is a delay while someone fixes the read error. The cost of failing open is an examination built on an image that may not match what was seized, which could be challenged much later in court. Priya writes a test for each failure path, including a disk that disappears halfway through hashing.
33.2 Ransomware resilience
Labs are targets. Write-once backups, an offline examination zone and anchored custody chains mean that even if the office zone is encrypted, evidence and records can be restored and checked.
Ransomware usually spreads through shared drives and stolen administrator credentials. The offline examination zone has no route from the office network, so a compromise there cannot reach evidence directly. Write-once backups cannot be encrypted after the fact, and the anchors let the lab confirm that restored records were not quietly altered before encryption began. Priya's plan also lists which office systems must be rebuilt before staff log in again.
33.3 Graceful degradation
If the server is down, examiners can continue using the signed offline export to read records, but cannot add entries until it is restored; paper forms bridge the gap and are entered afterwards with a reconciliation note.
The read-only export is regenerated every night and signed, so examiners can check it has not been altered before trusting it. Paper forms used during an outage carry the same fields as the electronic intake. When the server returns, each paper entry is typed in with its original handwritten time, and a reconciliation note links the electronic entry to the scanned form, so the custody history shows clearly that the gap happened and how it was bridged.
33.4 Human safety
Engineers consider people too: exposure to distressing material, lifting heavy server equipment, battery fires in phone storage. Design features that let examiners blur thumbnails until needed reduce unnecessary exposure.
Repeated exposure to abuse imagery is a known harm for examiners, so the blur setting is on by default and is lifted one item at a time with a logged reason. Server racks are mounted at waist height and moved by two people. Seized phones with swollen batteries go into a fire-resistant cabinet away from the main store, and the intake form has a box for battery condition so the risk is flagged on arrival.
33.5 Malware containment
Dynamic analysis machines are isolated from the examination and office zones, reset to clean snapshots after each sample, and never share storage with evidence.
A sample that escapes its analysis machine could alter evidence or spread to case files, which would damage both the case and the lab's credibility. The analysis network has no route to other zones, and files cross only through a one-way transfer of hashed reports. After each sample the machine is reverted to a clean snapshot, and the snapshot's own hash is checked monthly to show it has not changed.
33.6 Continuity rehearsal
Twice a year, the lab rehearses a total server loss: restore, verify, resume. Timings and problems are recorded.
In the first rehearsal, the restore takes nine hours rather than the planned four, because the spare server needed a firmware update before it would boot from the backup. The team adds the update to the monthly checklist. A second problem is that nobody can find the anchor printouts; they are now stored in a labelled folder in the safe. Each rehearsal ends with a short written list of fixes and owners.
33.7 Communication plan
During an outage, a named person informs case officers and courts of any delays.
That person has a contact list for case officers, the court liaison office and defence firms with pending requests, and template messages that give the expected delay without technical detail. Messages are logged with time and recipient. Hugo stresses that a court told early about a two-day delay is far more forgiving than one that finds out on the morning of a hearing. A deputy is named in case the main contact is unavailable.
Supplier resilience
Northfield depends on a single storage vendor for write-once media. Priya notes the risk and identifies a second compatible supplier, so a shortage cannot stop evidence from being preserved properly.
Worked example
Priya's rehearsal finds paper bridging forms lack a field for the hash of working copies created during the outage. She adds it, so later reconciliation can verify them.
Synthetic case. The rehearsal is invented.
Errors and limits
Rehearsals test known scenarios; unexpected failures still happen, so keep procedures adaptable.
Exercises
- EX097 — Fail closed. What should EvidenceDesk do when it cannot read a copy for verification? Rubric: 3 = block examination, log reason; 2 = partial; 1 = allow; 0 = none.
- EX098 — Degraded mode. Describe operation during a server outage. Rubric: 3 = read signed export, paper forms, later reconciliation; 2 = partial; 1 = stop all; 0 = none.
- EX099 — Rehearsal finding. What did the rehearsal change? Rubric: 3 = added hash field to paper forms; 2 = partial; 1 = vague; 0 = none.
Synthesis
Fail closed, degrade gracefully, protect people and rehearse recovery.
Continue studying — chapter 33 of 50
← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →