Chapter 12 — Digital forensics and malware analysis: Practice portfolio and final review
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 The portfolio"]
N2["12.2 End-to-end review"]
N3["12.3 What went well"]
N4["12.4 What to improve"]
N5["12.5 Final review with Dev"]
N6["12.6 Next steps"]
N7["12.7 Keeping skills current"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 The portfolio"]
N2["12.2 End-to-end review"]
N3["12.3 What went well"]
N4["12.4 What to improve"]
N5["12.5 Final review with Dev"]
N6["12.6 Next steps"]
N7["12.7 Keeping skills current"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 The portfolio]
|
v
[12.2 End-to-end review]
|
v
[12.3 What went well]
|
v
[12.4 What to improve]
|
v
[12.5 Final review with Dev]
|
v
[12.6 Next steps]
|
v
[12.7 Keeping skills current]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) assemble a practice portfolio; (2) reflect on strengths and gaps; (3) review the case end to end; (4) plan next learning steps.
12.1 The portfolio
Lena's portfolio holds: scope approvals, custody log, manifests, verification tables, timeline, report, lab sheets and her troubleshooting notes. Personal data is removed or replaced with synthetic values before it leaves the team. Each item shows a skill the course assessed: approvals show authority, the custody log and manifests show preservation, and the timeline and report show analysis and communication. The troubleshooting notes matter as much as the successes, because they show how Lena handled the 48-hour export, the duplicates and the proxy zone. Joy's name and supplier contacts are replaced before the portfolio goes to assessment.
12.2 End-to-end review
From the 10:00 report to closure on 10 March: containment within 20 minutes, evidence preserved before remediation, six recipients checked, three control gaps fixed, no payment lost. The supplier's phone check was the decisive defence. Read end to end, the case shows which steps carried the weight: the reset at 10:05 ended access after 51 minutes, the 10:12 export kept the rule, and the 11:10 scope widening answered whether others were affected. The weaker points were Lena's own handling errors, all caught by checks. Reviewing the whole week together makes those patterns visible in a way single checkpoints did not.
12.3 What went well
Fast containment; preservation of the rule before deletion; honest error logging. Containment started at 10:05, five minutes after the report, and was done by 10:20, so the attacker's session was closed within minutes of Kestrel's call. Exporting the rule at 10:12 before deletion kept the evidence that tied 'fwd' to the 09:14 session. Logging each error with its cause and fix meant the report could be trusted even where a first draft had been wrong. These are habits Lena intends to keep on every later case she handles.
12.4 What to improve
Lena's spreadsheet edit of a working copy; the default export range; late time-zone conversion. Each now has a runbook fix. All three share a cause: Lena trusted a default or a convenience instead of checking it. The spreadsheet saved over a working copy, the console chose a 48-hour range, and the proxy export kept its local zone. None changed a conclusion, because each was caught, but each cost time and needed a correction in the log. The runbook now addresses each one before the next case starts.
12.5 Final review with Dev
Dev assesses the portfolio against the course rubric: authority, preservation, analysis, verification, reporting and ethics, each scored 0–3. Each score rests on portfolio evidence, not on how the case felt. Authority, preservation, reporting and ethics each score 3. Analysis scores 2 because confidence was not stated for every finding, and verification scores 2 because checks started later than they should have. Dev and Lena agree one goal from the weakest areas instead of a long list, so it can be checked on the next case.
12.6 Next steps
Lena plans to learn endpoint triage and basic static malware triage under supervision, building on Sikorski and Honig (2012) for safe first steps. This case involved no malware, so endpoint and static triage are the parts of the course title Lena has not yet practised. Under supervision she will start with synthetic samples on an isolated training PC, describing behaviour and artefacts rather than running anything live. The same habits apply: written scope, hashes before analysis, notes during the work and sign-off from Dev.
12.7 Keeping skills current
Phishing techniques and cloud logs change; she sets a monthly hour to read provider change notes and team lessons. The case shows why: the look-alike domain was only two days old, and the console's export default surprised her. Provider changes can alter log fields or retention without warning, which would affect the next export. Lena adds what she learns to a short monthly team note, so changes reach colleagues, and Dev reviews whether the runbook needs updating as a result.
Feedback from others
Lena also asks Joy and the finance manager how the response felt from their side. Joy says the first call worried her because it began with questions; next time Lena will start by explaining that she is not in trouble. Such feedback rarely appears in logs but improves future cases.
Worked example
Dev's assessment: authority 3, preservation 3, analysis 2 ("state confidence for every finding"), verification 2 ("verify sooner"), reporting 3, ethics 3. Agreed goal: run the next case's verification table from day one.
Synthetic case. The assessment is invented.
Errors and limits
A portfolio shows past work; skill must be kept up with practice.
Exercises
- EX056 — Portfolio contents. List six portfolio items. Rubric: 3 = six of approvals, custody, manifests, verification, timeline, report, lab sheets, notes; 2 = four; 1 = two; 0 = none.
- EX057 — Decisive defence. What was the decisive defence, and why? Rubric: 3 = supplier phoned a known number; stopped payment change; 2 = partial; 1 = MFA; 0 = none.
- EX058 — Improvements. Name three improvements with their fixes. Rubric: 3 = working copy edit, default range, late zone conversion with runbook fixes; 2 = two; 1 = one; 0 = none.
- EX059 — Assessment goal. What goal came from the assessment? Rubric: 3 = verification table from day one; 2 = partial; 1 = vague; 0 = none.
- EX060 — Sanitising. Why sanitise the portfolio? Rubric: 3 = remove personal data before it leaves the team; 2 = partial; 1 = not needed; 0 = none.
Synthesis
A reviewed portfolio turns one case into lasting practice and a plan for further learning.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →