Chapter 3 — Digital forensics and malware analysis: specialist evidence
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 A parallel case"]
N2["3.2 Acquisition types"]
N3["3.3 Isolation"]
N4["Lab — comparing extractions"]
N5["3.4 Reading the result"]
N6["3.5 Interpretation"]
N7["3.6 Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 A parallel case"]
N2["3.2 Acquisition types"]
N3["3.3 Isolation"]
N4["Lab — comparing extractions"]
N5["3.4 Reading the result"]
N6["3.5 Interpretation"]
N7["3.6 Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 A parallel case]
|
v
[3.2 Acquisition types]
|
v
[3.3 Isolation]
|
v
[Lab — comparing extractions]
|
v
[3.4 Reading the result]
|
v
[3.5 Interpretation]
|
v
[3.6 Reporting]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) explain mobile acquisition types and their trade-offs; (2) interpret differences between extractions; (3) handle device isolation; (4) report specialist evidence with limits.
3.1 A parallel case
While the ransomware response continues, Corvane's legal team asks Marta's unit to examine a company-owned phone issued to an employee suspected of leaking customer data. The device policy authorises examination of company devices. The phone case brings different questions from CF-21: not how an attacker entered, but whether a named employee sent customer data outside. Because the employee may face discipline or legal action, the examination must be fair and proportionate from the start. Marta confirms with legal counsel which question is authorised before Aiyana touches the device.
3.2 Acquisition types
NIST SP 800-101r1 describes levels of mobile acquisition, from manual and logical extraction to file-system and physical methods. Logical extraction uses the device's own interfaces and yields user data the OS exposes; file-system extraction yields more, including app databases. For the Corvane phone, the team takes both a logical and a file-system extraction, so the difference between them can be measured rather than assumed. Physical extraction is not attempted because the device's security state does not allow it. The lab below compares the two extractions category by category using synthetic counts.
3.3 Isolation
The device is kept from networks (airplane mode or shielding) to prevent remote wiping or new data arriving, as SP 800-101r1 advises, and the steps are recorded. For the Corvane phone, Aiyana records when airplane mode was enabled, who did it and whether the device was then placed in a shielded bag. Isolation matters here because a remote wipe through the employee's account could destroy the chat database before extraction. Any notification or message that arrives before isolation is noted as received during handling.
Lab — comparing extractions
"""Compare artefact counts from two synthetic mobile extraction types."""
logical = {"sms": 412, "call_log": 230, "contacts": 180, "photos": 1900, "app_chat": 0}
fullfs = {"sms": 412, "call_log": 230, "contacts": 180, "photos": 1925, "app_chat": 3120}
for k in logical:
d = fullfs[k] - logical[k]
print(f"{k:9} logical={logical[k]:5} full_fs={fullfs[k]:5} extra={d}")
print("categories gained only by full_fs:", [k for k in logical if logical[k] == 0 and fullfs[k] > 0])
Run with python3 lab_mobile.py. Verified output:
sms logical= 412 full_fs= 412 extra=0
call_log logical= 230 full_fs= 230 extra=0
contacts logical= 180 full_fs= 180 extra=0
photos logical= 1900 full_fs= 1925 extra=25
app_chat logical= 0 full_fs= 3120 extra=3120
categories gained only by full_fs: ['app_chat']
3.4 Reading the result
SMS, call log and contacts counts are identical. Photos differ by 25 (likely cached or thumbnail files). The decisive difference is app_chat: zero in the logical extraction, 3,120 messages in the file-system extraction. A conclusion that "no chat activity exists" from the logical extraction alone would be wrong. The photo difference matters little to the leak question, but it shows that the two extractions do not see the same file system. The chat category matters a great deal, because it is where the alleged leak would be. Aiyana records that the logical extraction is incomplete for this phone, so no finding relies on it alone.
3.5 Interpretation
App databases need validated parsers; deleted records may be recoverable from free pages. Message timestamps and encodings vary by app version. For the 3,120 chat messages, Aiyana records the app version and the parser version, and checks the parser against a known test database before trusting its output. Deleted records recovered from free pages are reported separately from live ones. Timestamps are converted with care, because a wrong assumption about the app's time format would move messages by hours. Parser warnings and unparsed records are listed rather than silently dropped.
3.6 Reporting
The report names the extraction type for each finding and states what was not available. For the Corvane phone, the 14 messages with customer account numbers are reported as found in the file-system extraction, with the logical extraction noted as showing no chat data at all. Anything the extraction could not reach, such as encrypted app storage, is listed as unavailable. Readers can then judge what an absence of evidence means. The app version and parser version used for each finding are stated beside it.
3.7 Privacy
Personal messages on the company phone are reviewed only for the authorised question. The authorised question is whether customer data left through the phone, so Aiyana searches the chat data for customer account numbers and external contacts. Messages with family or friends that contain no customer data are not read beyond what that search needs. Photos stay unreviewed, as the proportionality judgement in the ethics discussion explains. The search terms and the reasons for them are recorded before the search runs, so the limit can be checked later.
Worked example
Aiyana reports: "File-system extraction yielded 3,120 messages from the chat app, absent from the logical extraction. Among them, 14 sent to an external contact contain customer account numbers (see exhibit list)." She notes the app version and parser version used.
Synthetic case. The device and counts are invented.
Errors and limits
Extraction capability depends on device model, OS version and security state; some data may be unreachable.
Exercises
- EX011 — Decisive difference. What was the decisive difference between extractions? Rubric: 3 = app_chat 0 vs 3,120; 2 = partial; 1 = photos; 0 = none.
- EX012 — Wrong conclusion. What wrong conclusion would logical-only data support? Rubric: 3 = no chat activity exists; 2 = partial; 1 = vague; 0 = none.
- EX013 — Isolation. Why isolate the phone from networks? Rubric: 3 = prevent remote wipe and new data; 2 = one; 1 = battery; 0 = none.
- EX014 — Report naming. Why name the extraction type for each finding? Rubric: 3 = shows what was available; limits interpretation; 2 = partial; 1 = style; 0 = none.
- EX015 — Authority. What authorises examining the phone? Rubric: 3 = company ownership and device policy; 2 = partial; 1 = suspicion; 0 = none.
Synthesis
Specialist evidence demands knowing what each acquisition method can and cannot reach, and saying so.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →