Chapter 8 — Independent review and defense | Master's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Independent review and defense

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Review by a second reader"]
  N2["8.2 The viva"]
  N3["8.3 Practice questions"]
  N4["8.4 Corrections"]
  N5["8.5 Dissemination"]
  N6["8.6 Ethical close-out"]
  N7["8.7 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Review by a second reader"]
  N2["8.2 The viva"]
  N3["8.3 Practice questions"]
  N4["8.4 Corrections"]
  N5["8.5 Dissemination"]
  N6["8.6 Ethical close-out"]
  N7["8.7 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes]
    |
    v
[8.1 Review by a second reader]
    |
    v
[8.2 The viva]
    |
    v
[8.3 Practice questions]
    |
    v
[8.4 Corrections]
    |
    v
[8.5 Dissemination]
    |
    v
[8.6 Ethical close-out]
    |
    v
[8.7 Next steps]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) prepare for independent review; (2) answer method and practice questions; (3) handle corrections; (4) plan dissemination.

8.1 Review by a second reader

Before submission, a lecturer outside the project reruns the scripts from the archive and checks three tables. One figure was mislabelled; Tomás fixes and logs it. Rerunning the scripts tests the archive as well as the results: if the second reader can reproduce the tables from the archive alone, examiners can too. The mislabelled figure had the axes correct but the legend reversed. Tomás records the fix in his revision log and reruns the script that produced it.

8.2 The viva

Examiners ask: Why NSRL? It is a public, documented reference set maintained by NIST. Why not fuzzy hashing? Scope; it is named as future work. Is synthetic data realistic? Answered with the clutter limitation and its likely effect. Tomás's answers draw directly on the thesis: the NSRL's public documentation, the scope decision recorded in the literature review, and the limitations chapter. He rehearses with Dr Osei and a colleague beforehand, practising short, direct answers that point to evidence in the thesis.

8.3 Practice questions

An external examiner from industry asks how a defence expert might challenge filtering in court. Tomás answers that the challenge is legitimate if files were set aside without being disclosed; the remedy is logging the filter, its reference version and its results. The question links the research to his police work, where filtering decisions may be examined by a defence expert. His answer reflects the practitioner summary: an examiner who logs the filter and its results can explain what was set aside and why. The examiners note that this makes the study useful beyond the university.

8.4 Corrections

Minor corrections are tracked in a table: comment, change, page. He submits within the deadline. The table makes it easy for examiners to check each change. Tomás completes the corrections within the deadline and Dr Osei confirms they are done. Where a correction affects a figure or table, he reruns the script from the archive and updates the log, so the final thesis and archive match. He also reruns the reproducibility check once more before final submission. The corrections table is filed with the final thesis, so the examiners can see how each of their comments was answered.

8.5 Dissemination

A short paper for a practitioner conference; the image builder and scripts released openly; a briefing to his unit. The practitioner paper reports the reduction results, the designed misses and the watch-list recommendation, with the limitations of synthetic images. Releasing the image builder and scripts lets other researchers test filtering on their own images. The briefing to his unit explains how to log filtering in case notes, using the practitioner summary from the thesis. Each output links to the archived version tag cited in the thesis.

8.6 Ethical close-out

Participant data from the agreement study are anonymised and stored per the ethics approval; no casework data were used. The examiners' responses are kept only as long as the approval allows and are then deleted, as the consent forms state. Tomás confirms to the ethics committee that the study ended as approved, with no deviations affecting participants. The confirmation is filed with the project archive, and Dr Osei signs it as supervisor. Synthetic images and scripts remain public, since they contain no personal data.

8.7 Next steps

The unit trials the watch-list practice for three months, measuring how often pulled-back files matter. The trial tests the recommendation his study proposed but did not evaluate. Examiners record each time a watch-list file is pulled back from the known set and whether it turned out to be relevant to the case. Tomás designs the recording form, and the unit's manager reviews the results after three months to decide whether to keep the practice. Tomás will present the trial's results to his unit alongside the thesis recommendation the trial was designed to test.

Rehearsal

Two weeks before the viva, Tomás rehearses with fellow students who play hostile examiners. They push on realism, sample size and the court question. He notes each weak answer and tightens it, citing the exact table or limitation that supports his reply, and practises saying "I do not know" where the data do not reach.

Worked example

Asked "So should examiners stop filtering?", Tomás replies: "No. Filtering reduced review sharply on these images. Examiners should log it, keep a dual-use watch list, and never describe filtered files as examined."

Synthetic case. The viva exchange is invented.

Errors and limits

Passing a viva validates the dissertation, not the method for every lab; local validation remains necessary.

Exercises

EX045 — Rerun check. What did the second reader do and find? Rubric: 3 = reran scripts; mislabelled figure; 2 = one; 1 = vague; 0 = none.
EX046 — Why NSRL. Justify the reference set choice. Rubric: 3 = public, documented, NIST-maintained; 2 = partial; 1 = popular; 0 = none.
EX047 — Court challenge. How should the court-challenge question be answered? Rubric: 3 = legitimate if undisclosed; log filter, version, results; 2 = partial; 1 = dismiss; 0 = none.
EX048 — Corrections table. What columns does the corrections table hold? Rubric: 3 = comment, change, page; 2 = two; 1 = one; 0 = none.
EX049 — Stop filtering? Summarise the answer to "stop filtering?" Rubric: 3 = no; log, watch list, accurate wording; 2 = partial; 1 = yes; 0 = none.
EX050 — Local validation. Why does a passed viva not validate the method everywhere? Rubric: 3 = labs differ; local validation needed; 2 = partial; 1 = it does; 0 = none.

Synthesis

Have the work rerun, answer with bounded claims, track corrections and give practitioners something usable.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →