Chapter 8 — Digital forensics and malware analysis: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Anti-forensics"]
N2["8.2 Detecting manipulation"]
N3["8.3 Contradictions"]
N4["8.4 Attribution"]
N5["8.5 Incomplete evidence"]
N6["8.6 Communicating uncertainty"]
N7["8.7 Peer review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Anti-forensics"]
N2["8.2 Detecting manipulation"]
N3["8.3 Contradictions"]
N4["8.4 Attribution"]
N5["8.5 Incomplete evidence"]
N6["8.6 Communicating uncertainty"]
N7["8.7 Peer review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Anti-forensics]
|
v
[8.2 Detecting manipulation]
|
v
[8.3 Contradictions]
|
v
[8.4 Attribution]
|
v
[8.5 Incomplete evidence]
|
v
[8.6 Communicating uncertainty]
|
v
[8.7 Peer review]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) handle anti-forensic activity and contradictory evidence; (2) reason about attribution limits; (3) manage incomplete evidence; (4) communicate uncertainty to executives and regulators.
8.1 Anti-forensics
On WS-07 the security log was cleared, and the ransomware deleted volume shadow copies. Some file timestamps on a dropped tool show a creation year of 2009 — far older than the OS installation. Altered timestamps are a known anti-forensic technique. Each of these acts targets a different evidence source: clearing removes the security log, deleting shadow copies removes earlier versions of files, and altered timestamps hide when a tool arrived. None of them stops an investigation on its own, however thorough it is. Together they push examiners to rely on sources the attacker did not or could not alter.
8.2 Detecting manipulation
Comparing file-system timestamps with other sources — the file's appearance in a directory listing captured by triage, entries in the NTFS change journal, prefetch first-run time — exposes inconsistency. Carrier (2005) explains the separate metadata structures that make such cross-checks possible. On WS-07, the dropped tool's 2009 creation time conflicts with the triage listing and with the change journal, which shows the file arriving during the intrusion. Prefetch records the tool's first execution on the same night as the intrusion. When three independent sources agree against one timestamp, the report treats that timestamp as altered and says why.
8.3 Contradictions
The firewall shows 18 GB leaving the file server to an external host at 02:40; the file server's own logs show no unusual reads. Possibilities: logging gaps, a different source host behind NAT, or data staged elsewhere. Each is tested. The contradiction is not resolved by choosing the more convenient source. Logging gaps are checked by looking for missing intervals in the file server's logs, NAT by retrieving the firewall's translation table, and staging by examining other hosts that could reach the customer share. Each test is written up with its method and result, including tests that found nothing.
8.4 Attribution
The ransom note names a known criminal group. Attribution to a specific group from a note is weak — notes are copied — and is not required for the forensic questions. Marta's report records the claim without endorsing it. Copying another group's note costs a criminal nothing, so a name in a note proves little. The forensic questions for CF-21, about entry, spread and data loss, can be answered without knowing who the attackers were. If law enforcement later attributes the attack, the report's findings remain valid either way.
8.5 Incomplete evidence
Two hosts were rebuilt before preservation. The report states which questions this leaves partly unanswered. For CF-21 the two rebuilt servers mean that some questions about lateral movement cannot be fully answered. The report names those questions, says which other sources, such as central logs and domain controller records, narrow them where possible, and states that the gap comes from rebuilding before preservation. That candour is also the strongest argument for the forensic gate added afterwards. The report does not present the narrowed answers as if the rebuilt servers had been examined.
8.6 Communicating uncertainty
Executives want yes/no. Marta uses calibrated statements: "Evidence supports exfiltration of approximately 18 GB from the file server segment; which files cannot yet be determined." The statement gives executives a figure they can act on and a clear boundary on what is not yet known. It avoids both 'no data were taken' and 'all customer data were stolen', neither of which the evidence supports. Marta uses the same structure for every major finding: what the evidence supports and what remains open.
8.7 Peer review
Difficult findings get a second senior reviewer. For CF-21 the backup-server staging finding and the timestamp manipulation on WS-07 both receive a second senior reviewer. The reviewer works from the evidence and the examiner's notes, not from the conclusion. The second reviewer must not have worked on the finding, so their view is independent. Where the reviewer disagrees, the disagreement is resolved before the report goes to counsel or the regulator; the report states the final position and why, and the disagreement stays in the case record. For CF-21 this added a day before the report went out, which Marta judged worth it given the regulator's interest.
Worked example
The NAT table, retrieved from the firewall's memory export, maps the 02:40 transfer to the backup server, not the file server. The backup server's logs show a bulk read of the customer share at 02:35. The contradiction resolves: data were staged via the backup server.
Synthetic case. The evidence is invented.
Errors and limits
Resolving one contradiction can create confidence that is not warranted elsewhere; keep testing other findings.
Exercises
- EX036 — Timestamp anomaly. How can the 2009 creation time be exposed as manipulated? Rubric: 3 = cross-check change journal, triage listing, prefetch first run; 2 = partial; 1 = accept; 0 = none.
- EX037 — Contradiction options. List three explanations for the 18 GB contradiction. Rubric: 3 = logging gap, NAT source, staging elsewhere; 2 = two; 1 = one; 0 = none.
- EX038 — Resolution. How was the contradiction resolved? Rubric: 3 = NAT table mapped to backup server; bulk read at 02:35; 2 = partial; 1 = vague; 0 = none.
- EX039 — Ransom-note attribution. Why not endorse the group named in the note? Rubric: 3 = notes copied; weak evidence; not needed for questions; 2 = partial; 1 = endorse; 0 = none.
- EX040 — Calibrated statement. Write a calibrated exfiltration statement. Rubric: 3 = supports ~18 GB from segment; files undetermined; 2 = partial; 1 = yes/no; 0 = none.
Synthesis
Difficult cases demand cross-checks, tested alternatives, restrained attribution and calibrated communication.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →