Chapter 8 — Digital forensics and malware analysis: supervised case analysis
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Sources"]
N2["8.2 Time zones"]
N3["8.3 The narrative"]
N4["8.4 Gaps"]
N5["8.5 Supervisor review"]
N6["8.6 Alternative narratives"]
N7["8.7 Peer reproduction"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Sources"]
N2["8.2 Time zones"]
N3["8.3 The narrative"]
N4["8.4 Gaps"]
N5["8.5 Supervisor review"]
N6["8.6 Alternative narratives"]
N7["8.7 Peer reproduction"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Sources]
|
v
[8.2 Time zones]
|
v
[8.3 The narrative]
|
v
[8.4 Gaps]
|
v
[8.5 Supervisor review]
|
v
[8.6 Alternative narratives]
|
v
[8.7 Peer reproduction]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) build a timeline from several sources; (2) link events into a narrative; (3) present analysis for supervisor review; (4) respond to challenge.
8.1 Sources
Proxy log (Joy's visit to the look-alike page), sign-in log, mailbox audit (rule creation), message trace (the bank-change email) and IT's change record (reset). Each source answers a different part of the story and uses its own identifiers. The proxy names Joy's PC and the domain, the sign-in log names the address and session, the audit record shows the rule and session, message trace shows sender, recipient and subject, and IT's change record shows the reset. Lena lists each source with its export time and time zone before merging anything.
8.2 Time zones
All exports are set to UTC before merging, so times line up. The case notes say which zone is used. Without one zone, the order of events can be wrong even when every record is accurate. Marlow's proxy export used local time, an hour different from the UTC sign-in and audit records, so the 09:10 page visit at first appeared out of place. Lena converts each export and writes the original zone and the conversion in the case notes, so a reviewer can redo it.
8.3 The narrative
Joy opened the look-alike page at 09:10; the attacker signed in at 09:14; created the forward rule at 09:20; sent the bank-change email at 09:40; IT reset the password at 10:05. Chapter 11's lab rebuilds this timeline from the synthetic records. Every step has its own record: the proxy log for 09:10, the sign-in log for 09:14, the mailbox audit for 09:20, message trace for 09:40 and IT's change record for 10:05. The intervals are worth noting too, with four minutes from page visit to sign-in and twenty-six minutes from sign-in to the fraudulent email.
8.4 Gaps
Nothing shows what the attacker read between 09:14 and 09:40. Lena records the gap rather than guessing. Reading a message may not be logged at every licence level, so the absence of records does not mean the attacker read nothing. In those 26 minutes they could have opened supplier correspondence to make the bank-change email convincing, but no record shows it either way. Lena writes the gap into the timeline and the report's limits, and tells the data protection lead that the mailbox contents cannot be shown to be unread.
8.5 Supervisor review
Dev challenges each step: "How do you know the 09:14 session created the rule?" Lena points to the session identifier shared by the sign-in and audit records. Dev's questions follow the chain link by link: how the 09:10 visit is tied to Joy's PC, why the 09:14 sign-in was not Joy, and what shows the bank-change email came from the same session. Where Lena has a record, she shows it; where she does not, as for the 09:14–09:40 gap, she says so. Dev signs the conclusions only when every link has an answer.
8.6 Alternative narratives
Could Joy have created the rule herself by mistake? The session came from the attacker's address, and Joy says she did not. The alternative is rejected with reasons. The test is the same one used for the sign-in: name the innocent explanation, then find the record that would support or refute it. If the rule had been created from Joy's office address and her own session, the alternative would have stayed open. Lena records the rejected narrative and its reasons in the case notes, so a later reader can see it was considered and not ignored.
8.7 Peer reproduction
A colleague rebuilds two links from Lena's notes alone and gets the same result. The colleague works only from the notes and the evidence share, without asking Lena questions. The two links chosen are the session identifier joining the 09:14 sign-in to the 09:20 rule, and the 09:40 bank-change email in message trace. Matching results show the notes are complete enough for someone else to follow. Had the colleague been unable to rebuild a link, Lena would have fixed the notes before the report went to Dev.
Preparing for review
Before the checkpoint Lena sends Dev her timeline and the records behind it an hour early. Reviewing beforehand lets him prepare questions, and the meeting is spent on reasoning rather than reading. She also lists the parts she is least sure of, so review effort goes where it is most needed.
Worked example
Lena's slide for the checkpoint: five boxes in a row with time, source and event, a red marker for the 09:14–09:40 gap, and a footnote: "All times UTC. Session ID links sign-in and rule creation."
Synthetic case. The analysis is invented.
Errors and limits
Narratives are tempting; each link must point to a record.
Exercises
- EX036 — Sources used. Name four sources in the timeline. Rubric: 3 = proxy, sign-in, mailbox audit, message trace, change record (four); 2 = three; 1 = one; 0 = none.
- EX037 — Narrative. Give the five events with times. Rubric: 3 = 09:10, 09:14, 09:20, 09:40, 10:05 correct; 2 = four; 1 = two; 0 = none.
- EX038 — Linking evidence. How did Lena link the sign-in to the rule? Rubric: 3 = shared session identifier; 2 = same IP only; 1 = guess; 0 = none.
- EX039 — The gap. What gap was recorded, and why not fill it? Rubric: 3 = what attacker read 09:14–09:40; no records; 2 = partial; 1 = filled; 0 = none.
- EX040 — Rejected alternative. Why was "Joy made the rule" rejected? Rubric: 3 = session from attacker address; Joy denies; 2 = one; 1 = accepted; 0 = none.
Synthesis
Merge sources in one time zone, link events by records, record gaps and answer challenges with evidence.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →