Chapter 11 — Digital forensics and malware analysis: Supervised laboratory
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 The lab"]
N2["11.2 The task"]
N3["Lab — merging sources"]
N4["11.3 Reading the result"]
N5["11.4 Expected output"]
N6["11.5 Extending the lab"]
N7["11.6 Lab notes"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 The lab"]
N2["11.2 The task"]
N3["Lab — merging sources"]
N4["11.3 Reading the result"]
N5["11.4 Expected output"]
N6["11.5 Extending the lab"]
N7["11.6 Lab notes"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 The lab]
|
v
[11.2 The task]
|
v
[Lab — merging sources]
|
v
[11.3 Reading the result]
|
v
[11.4 Expected output]
|
v
[11.5 Extending the lab]
|
v
[11.6 Lab notes]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) rebuild an incident timeline in a contained lab; (2) work only on synthetic records; (3) check results against expected output; (4) document lab work to case standard.
11.1 The lab
The lab uses synthetic records derived from the case pattern, on a training PC not connected to company systems. No real mailbox data and no live phishing pages are used. The training PC has no route to Marlow's email service, proxy or file shares, so nothing in the lab can reach a real system. The records reuse the case's times, the account name j.okafor and documentation addresses such as 203.0.113.50, but no real message content. That keeps the exercise close to the case while removing personal data and any chance of touching live evidence.
11.2 The task
Merge five events from four sources into one ordered timeline and confirm the narrative from chapter 8. The five events are the page visit, the sign-in, the rule creation, the bank-change email and the reset, and they come from the proxy, sign-in log, mailbox audit and message trace. The script lists them deliberately out of order, so sorting has real work to do. Lena's job is to run it, check the output against the expected order and explain any line that does not fit.
Lab — merging sources
"""Merge synthetic records from four sources into one ordered timeline."""
events = [
("09:20", "mail-audit", "inbox rule 'fwd' created for j.okafor"),
("09:10", "proxy", "j.okafor opens login-marlow.example.net"),
("09:40", "message-trace", "j.okafor sends 'Updated bank details' to supplier"),
("09:14", "sign-in", "j.okafor success from 203.0.113.50"),
("10:05", "mail-audit", "password reset and sessions revoked by IT"),
]
for t, src, what in sorted(events):
print(t, f"{src:13}", what)
Run with python3 lab_timeline.py. Verified output:
09:10 proxy j.okafor opens login-marlow.example.net
09:14 sign-in j.okafor success from 203.0.113.50
09:20 mail-audit inbox rule 'fwd' created for j.okafor
09:40 message-trace j.okafor sends 'Updated bank details' to supplier
10:05 mail-audit password reset and sessions revoked by IT
11.3 Reading the result
Sorted by time, the events read: 09:10 proxy visit, 09:14 sign-in, 09:20 rule creation, 09:40 bank-change email, 10:05 reset. The order matches the narrative, and each line names its source. Two lines share the mail-audit source, the rule creation and the reset, which is why five events come from four sources; in the case itself the reset is also confirmed by IT's change record. The output does not prove the narrative by itself; it shows the records can be put in one consistent order. The links between them, such as the session identifier, still come from the evidence rather than from the script.
11.4 Expected output
Dev supplies the expected output in a sealed note. Lena compares after running; a mismatch would mean a mistake in input or code. Writing the expected output before the run stops anyone adjusting expectations to fit what appeared. Dev's note lists the five lines in order with their sources, so the comparison is line by line. If a line had not matched, Lena would check the input times and the sort key before blaming the script, and record the mismatch in her lab notes.
11.5 Extending the lab
Lena adds a sixth synthetic event — the supplier's 10:50 phone call — and re-runs; it sorts last as expected. Extending a lab tests that she understands it, not just runs it. The new event comes from Lena's contact log, a fifth source, and is written in the same 'HH:MM' form as the others. It sorts last because 10:50 follows the 10:05 reset both as text and as time. Had she typed '9:40' without the leading zero, the text sort would have put it after '10:05', which shows why consistent formats matter.
11.6 Lab notes
Notes record script version, input, output and comparison with expected results. For this run the notes record lab_timeline.py v1, its hash from the reviewed folder, the five input events, the five output lines and the result of comparing them with Dev's sealed note. The extension with the 10:50 call is recorded separately, with its changed input. Notes are written during the run, not afterwards, so they show what actually happened. Another learner should be able to repeat the session from them alone.
11.7 Supervisor sign-off
Dev observes the run and signs the lab sheet. Observing the run lets Dev see that Lena reads the output and compares it, rather than only typing the command. His signature goes on the lab sheet beside the script version and the result, as in the worked example. A sheet without sign-off does not count towards the portfolio. If Dev had seen a mistake, he would record it and ask for a rerun, logged as a second attempt rather than replacing the first.
Setting up the lab
Before each session the training PC is reset to a clean snapshot, the lab scripts are copied from the reviewed folder and their hashes are checked against the list. Starting from a known state means any difference in output comes from the exercise itself, not leftovers from a previous learner.
Worked example
Lab sheet: "lab_timeline.py v1 — 5 events, 4 sources — output order matches expected — extension with 10:50 call sorted correctly — observed and signed D. Anand."
Synthetic case. All lab records are invented.
Errors and limits
Sorting by "HH:MM" text works only within one day and one zone; real timelines need full timestamps.
Exercises
- EX051 — Lab safety. What keeps the lab safe? Rubric: 3 = synthetic records, isolated PC, no real mailboxes or live pages; 2 = partial; 1 = vague; 0 = none.
- EX052 — Lab order. Give the sorted order of events. Rubric: 3 = 09:10 proxy, 09:14 sign-in, 09:20 rule, 09:40 email, 10:05 reset; 2 = minor slip; 1 = wrong; 0 = none.
- EX053 — Expected output. Why use a sealed expected output? Rubric: 3 = detect input/code mistakes without bias; 2 = partial; 1 = no reason; 0 = none.
- EX054 — Extension. What extension was made, and what did it show? Rubric: 3 = added 10:50 call; sorted last; shows understanding; 2 = partial; 1 = vague; 0 = none.
- EX055 — Sorting limit. What is the limit of sorting by HH:MM text? Rubric: 3 = one day and one zone only; need full timestamps; 2 = partial; 1 = vague; 0 = none.
Synthesis
Contained labs build skill safely; compare with expected output and extend the lab to prove understanding.
Continue studying — chapter 11 of 12
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →