Chapter 6 — Digital forensics and malware analysis: operational workflow
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 The workflow"]
N2["6.2 Triage"]
N3["6.3 Checkpoints"]
N4["6.4 Containment in this case"]
N5["6.5 Widening scope"]
N6["6.6 Task tracking"]
N7["6.7 Closure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 The workflow"]
N2["6.2 Triage"]
N3["6.3 Checkpoints"]
N4["6.4 Containment in this case"]
N5["6.5 Widening scope"]
N6["6.6 Task tracking"]
N7["6.7 Closure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 The workflow]
|
v
[6.2 Triage]
|
v
[6.3 Checkpoints]
|
v
[6.4 Containment in this case]
|
v
[6.5 Widening scope]
|
v
[6.6 Task tracking]
|
v
[6.7 Closure]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) follow a repeatable workflow from report to closure; (2) use checkpoints with a supervisor; (3) track tasks; (4) close cases properly.
6.1 The workflow
Report received → triage and scope → contain → preserve → analyse → verify → report → close with lessons. NIST SP 800-61 describes similar phases; Marlow's runbook adapts them to its size. In Marlow's case the phases overlap in time but keep their order: containment started at 10:05 with the reset, yet removing the forward rule waited for preservation at 10:12. Analysis of the sign-in and audit records ran through the morning, containment was verified from 14:00, and the case closed on 10 March. Each phase ends with an entry in the ticket, so anyone can see where the case stands.
6.2 Triage
Triage decides urgency. A bank-change email to a supplier is urgent because money could move within hours. Once a payment runs, recovering the money can depend on banks rather than on Marlow. Until the reset at 10:05, the live session could also still send more mail to suppliers. Lena therefore treats the case as urgent from the 10:00 call, and Dev approves scope two minutes later. Less urgent signals, such as a phishing email nobody clicked, would wait for normal queue order.
6.3 Checkpoints
Dev signs off at three checkpoints: scope at the start, containment actions, and conclusions before reporting. Lena brings evidence to each. In this case the scope checkpoint was Dev's 10:02 approval of Joy's mailbox and sign-in logs, and the containment checkpoint covered the reset, the rule removal after export and the blocks. The conclusions checkpoint at 14:00 used Lena's timeline slide with the gap marked. Bringing records rather than opinions to each meeting lets Dev challenge a step and see the answer straight away.
6.4 Containment in this case
Password reset, sign-out of all sessions, removal of the forward rule after export, block of 203.0.113.50 and the look-alike domain at the proxy, and a check that multi-factor authentication is enrolled for Joy. Each action closes a different route: the reset stops use of the captured password, revoking sessions ends access that no longer needs the password, and removing 'fwd' stops copies leaving. Blocking 203.0.113.50 and the look-alike domain protects the other recipients of the phishing email. The MFA check matters most, because without a second factor a captured password could open the mailbox again.
6.5 Widening scope
Was the phishing email sent to others? Message trace shows it reached six Marlow mailboxes. Dev widens scope in writing to those six. Proxy records show that none of the other recipients, m.lee among them, visited the page. The wider check shows why scope is widened in writing rather than by habit: six mailboxes received the same lure, but only Joy's account shows a click and a new sign-in. Dev's 11:10 approval lets Lena read the trace and proxy records for those recipients, and nothing more. Their mailboxes stay closed because no record suggests they were accessed.
6.6 Task tracking
Each action is a ticket task with owner and status, so nothing depends on memory. For Marlow the ticket holds tasks such as 'export inbox rules' for Lena, 'remove forward rule after export' for IT, 'confirm no supplier record changed' for finance and 'brief data protection lead' for Lena. Each task shows its owner, its status and the time it was closed. When IT was ready to delete the rule, the ticket already showed the export as done, so the removal at 10:15 needed no extra call.
6.7 Closure
A case closes when actions are complete, stakeholders informed, evidence archived per retention, and lessons recorded. Marlow's case closes on 10 March, a week after the report. By then the three control changes have tickets and tests, Joy, finance, Kestrel and the data protection lead have been told the outcome, and the evidence share /IR-0303 is archived under retention. Lessons include the export range, the working-copy edit and the time-zone conversion, each turned into a runbook change. Closing without the lessons step would leave the next analyst to repeat the same mistakes.
Handovers
If the case runs past Lena's shift, she writes a handover note: current phase, open tasks with owners, next checkpoint time and anything waiting on others. The next analyst reads the ticket and note together and confirms receipt, so no action is dropped or done twice. Handover notes stay in the ticket as part of the record.
Worked example
Lena's ticket at 12:00: "Contain — done (10:05–10:20). Preserve — done, manifest of 6 items. Scope widened 11:10 to 6 recipients; no other clicks found. Analyse — in progress. Next checkpoint with Dev 14:00."
Synthetic case. The ticket is invented.
Errors and limits
Workflows guide, not replace, judgement; unusual cases need supervisor input.
Exercises
- EX026 — Phase order. Put the workflow phases in order. Rubric: 3 = report, triage/scope, contain, preserve, analyse, verify, report, close; 2 = minor slip; 1 = jumbled; 0 = none.
- EX027 — Urgency. Why was this case urgent? Rubric: 3 = supplier payment could be redirected within hours; 2 = partial; 1 = not urgent; 0 = none.
- EX028 — Containment list. List four containment actions. Rubric: 3 = reset, revoke sessions, rule removal after export, block IP/domain, MFA check; 2 = three; 1 = one; 0 = none.
- EX029 — Other recipients. How was the wider exposure checked? Rubric: 3 = message trace found 6 recipients; scope widened in writing; proxy showed no other visits; 2 = partial; 1 = assumed; 0 = none.
- EX030 — Closing a case. State the closure conditions. Rubric: 3 = actions done, stakeholders informed, evidence archived, lessons recorded; 2 = three; 1 = one; 0 = none.
Synthesis
A repeatable workflow with supervisor checkpoints keeps cases complete and defensible.
Continue studying — chapter 06 of 12
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →