◇ OpenCyber Academy
Engineering · Chapter 37 · English

Chapter 37 — Digital forensics and malware analysis: operations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 37 — Digital forensics and malware analysis: operations

Lesson map

Lesson 37 published. Map, example, EX109.

flowchart TD
  N0["Learning outcomes"]
  N1["37.1 Standard operating procedures"]
  N2["37.2 Roles"]
  N3["37.3 Daily checks"]
  N4["37.4 Handover"]
  N5["37.5 Incidents in the system"]
  N6["37.6 Change windows"]
  N7["37.7 Training"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX109"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["37.1 Standard operating procedures"]
  N2["37.2 Roles"]
  N3["37.3 Daily checks"]
  N4["37.4 Handover"]
  N5["37.5 Incidents in the system"]
  N6["37.6 Change windows"]
  N7["37.7 Training"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX109"]

[Learning outcomes]
    |
    v
[37.1 Standard operating procedures]
    |
    v
[37.2 Roles]
    |
    v
[37.3 Daily checks]
    |
    v
[37.4 Handover]
    |
    v
[37.5 Incidents in the system]
    |
    v
[37.6 Change windows]
    |
    v
[37.7 Training]
    |
    v
[Worked example] --> [Exercise EX109]

Learning outcomes

You will (1) write operating procedures for EvidenceDesk; (2) define roles and handovers; (3) monitor daily operation; (4) handle incidents in the evidence system.

37.1 Standard operating procedures

Short, numbered procedures: intake, acquisition registration, verification, export, correction, exception. Each states purpose, role, steps, records produced and what to do if something fails. SWGDE publishes model procedures and best-practice documents that Priya uses as a structural reference.

Numbering matters because a court may ask exactly which step was followed, and 'step 4 of the verification procedure' is far easier to point to than a paragraph of prose. Each procedure fits on two pages, so it is actually read at the bench. Version numbers and effective dates sit in the header, and EvidenceDesk records which version was in force when each action was taken.

37.2 Roles

Intake clerk, examiner, reviewer, administrator, quality manager. A role matrix shows who may do what.

In the matrix, intake clerks create items and record receipts but cannot mark verification complete; examiners verify and examine but cannot approve their own corrections; reviewers approve corrections but cannot delete anything; administrators maintain the server but have no case-level permissions. The quality manager can read everything and approve procedure changes. EvidenceDesk enforces the matrix in code, and the test suite checks one forbidden action for every role.

37.3 Daily checks

Chain verification result, backup completion, queue status, disk space. The quality manager signs the daily check sheet.

Each item has a clear pass condition: the chain verifies to the latest anchor, last night's backup completed with matching hashes, no job has sat in the queue more than a day, and free disk space exceeds twenty percent. Any failure is written on the sheet with the action taken. A run of signed sheets shows an auditor that the checks happened every day, not just before inspections.

37.4 Handover

When an examiner hands a case to another, EvidenceDesk records the transfer and the receiving examiner verifies working copies before continuing.

Handovers happen when an examiner goes on leave, changes role, or is assigned a more urgent case. The receiving examiner rehashes each working copy and compares it with the recorded value before relying on any earlier notes. This protects both people: the outgoing examiner can show what state they left the work in, and the incoming one is not blamed for problems that existed before they took over.

37.5 Incidents in the system

A failed chain check is a quality incident: stop dependent work, preserve logs, investigate, correct through the proper path, and report to the quality manager.

Stopping dependent work prevents new examinations from relying on records that may be wrong. Preserving logs comes before any repair, because fixing first can destroy the clues about what happened. The investigation might find a disk fault, a bug, or a deliberate edit. Whatever the cause, the correction goes through the normal correction entry, never a direct file edit, and affected cases are listed for the quality manager.

37.6 Change windows

Updates happen outside examination hours after a backup and are followed by the vector tests.

Running updates during examination hours risks a half-installed version writing records, or an examiner losing work when the service restarts. The backup taken just before gives a known point to return to if the update fails. Running the vector tests immediately afterwards confirms that hashing still matches the published values. Each update, with its version, time and test result, is entered in the change log by the administrator.

37.7 Training

New staff complete the procedures with synthetic items before handling real ones.

Synthetic items look like real ones, with labels, bags and small disk images, but contain nothing sensitive and belong to no case. Trainees run each procedure end to end, including deliberately triggered failures such as a hash mismatch, so their first encounter with an error is not on live evidence. A supervisor signs off each procedure, and EvidenceDesk only grants the role once training is recorded. Refresher sessions follow any procedure change.

Metrics in operation

Monthly, Priya's dashboard reports intakes, acquisitions, verification failures, exceptions used and restore-test results. A rising exception count prompts review of whether a control is too awkward. Figures are discussed at the quality meeting and recorded in its minutes, so trends are visible over years and changes can be judged by their effect.

Worked example

On Monday the chain check fails. Logs show an administrator restored a file from Friday's backup during maintenance, losing entries made over the weekend. The weekend entries are re-entered from paper bridging forms and the anchors, the cause is recorded, and the maintenance procedure gains a "reconcile after restore" step.

Synthetic case. The incident is invented.

Errors and limits

Procedures age; review them yearly and after every incident.

Exercises

Synthesis

Clear procedures, roles, daily checks and incident handling keep EvidenceDesk trustworthy in use.

Continue studying — chapter 37 of 50

← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →