◇ OpenCyber Academy
Postgraduate · Chapter 2 · English

Chapter 2 — Digital forensics and malware analysis: current practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Digital forensics and malware analysis: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 From dead-box to live response"]
  N2["2.2 Targeted collection"]
  N3["2.3 Memory forensics"]
  N4["2.4 Cloud"]
  N5["2.5 Standards still apply"]
  N6["2.6 Validation"]
  N7["2.7 Practitioner literature"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 From dead-box to live response"]
  N2["2.2 Targeted collection"]
  N3["2.3 Memory forensics"]
  N4["2.4 Cloud"]
  N5["2.5 Standards still apply"]
  N6["2.6 Validation"]
  N7["2.7 Practitioner literature"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 From dead-box to live response]
    |
    v
[2.2 Targeted collection]
    |
    v
[2.3 Memory forensics]
    |
    v
[2.4 Cloud]
    |
    v
[2.5 Standards still apply]
    |
    v
[2.6 Validation]
    |
    v
[2.7 Practitioner literature]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) survey current forensic practice for enterprise incidents; (2) compare traditional imaging with targeted collection; (3) describe memory and cloud forensics in practice; (4) judge new practice against standards.

2.1 From dead-box to live response

Traditional practice imaged powered-off disks. Modern enterprise incidents involve hundreds of hosts, encrypted disks, cloud services and memory-resident malware. Practice now combines targeted live collection, memory capture and log analysis, while still imaging critical hosts. CF-21 shows the mix: 40 hosts with BitLocker-style disk encryption would take most of a day to image one by one, while ransomware activity and live connections exist only in memory. Marta's unit therefore captures memory and targeted artefacts broadly and reserves full images for the hosts most likely to answer the entry and exfiltration questions.

2.2 Targeted collection

Collecting specific artefacts (event logs, registry hives, browser data, file system metadata) from many hosts answers scoping questions quickly. NIST SP 800-86 recognises the need to balance data volatility, value and effort when choosing what to collect. In CF-21 the endpoint agent pulls these artefacts from all 40 hosts in two hours, which is how the team learns that WS-07 ran the ransomware binary first at 03:12. A full image of every host would have taken far longer and delayed recovery. The trade-off is that only listed artefacts survive the rebuild.

2.3 Memory forensics

Memory captures reveal running processes, injected code, network connections and sometimes encryption keys. They must be captured before shutdown, and the capture tool's footprint recorded. For CF-21, memory was taken from eight representative hosts chosen by role before any were shut down. Each capture records the tool and version, the time and the examiner, together with a note of the processes the capture tool itself added. Without that note, the tool's own activity could later be mistaken for the attacker's.

2.4 Cloud

Cloud audit logs, identity logs and storage access records are collected through provider interfaces under the organisation's authority. Retention is set by configuration and contract, so readiness matters. Corvane's VPN and identity logs matter most here, because the entry point turned out to be a phishing-compromised VPN account. Those logs are pulled through the provider's administrative interface by a named examiner, hashed and logged like any other evidence. If retention had been set shorter than the attacker's dwell time, the entry would have been unprovable.

2.5 Standards still apply

ISO/IEC 27037 principles — auditability, repeatability, justifiability — apply equally to targeted and live collection. The record must show what was collected, how and why. For CF-21, each agent collection records the host, the artefact list, the time, the examiner and the hash of the returned package. Collection from a live host changes it slightly, so the record also notes what the agent did. A reviewer reading the record should be able to see why each artefact was chosen and repeat the collection on a similar host.

2.6 Validation

New collection tools need validation for the artefacts they claim to collect; NIST CFTT and in-house tests support this. Before CF-21 the endpoint agent had been tested on synthetic hosts to confirm that it returns complete event logs, registry hives and prefetch files without altering timestamps it reports. If a tool silently skips locked files, triage results would look cleaner than reality. The validation record is cited whenever the agent's output supports a finding in the report. Validation is repeated whenever the agent is upgraded to a new version.

2.7 Practitioner literature

SWGDE publishes best-practice documents on topics including live and targeted collection; Marta's team keeps a reading list. Reading the published guidance keeps the team's methods close to what peers and courts expect. When the unit adopted endpoint-agent triage, it compared its procedure against SWGDE material on live collection before using it on cases. The reading list is reviewed when practice changes, so outdated guidance does not stay on it unnoticed. New members of the team read the core documents during their first month.

Worked example

Aiyana Brooks, Marta's senior examiner, collects event logs, prefetch, registry hives and file-system metadata from all 40 hosts in two hours via the endpoint agent, while full images are taken of the first-infected workstation and the domain controller. The targeted data show the ransomware binary first ran on WS-07 at 03:12.

Synthetic case. The incident is invented.

Errors and limits

Targeted collection captures only what was asked for; artefacts not on the list are lost if hosts are rebuilt.

Exercises

Synthesis

Current practice blends targeted, live, memory and cloud collection with selective imaging — all under the same documentation principles.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →