## Chapter 1 — Digital forensics and malware analysis: foundations and decisions ### Learning outcomes You will (1) explain in plain words what digital forensics and malware analysis are; (2) define malware, artefact, evidence, hash and incident; (3) describe the first decisions after something looks wrong; (4) meet the course case. ### 1.1 What the field is Digital forensics is the careful study of computers and accounts to find out what happened, in a way other people can check. Malware analysis looks at suspicious programs to learn what they do. Both help people respond to incidents: NIST SP 800-61 describes response as preparing, detecting and analysing, containing and recovering, then learning lessons. In this course the incident is small: one laptop at a food bank showing fake virus alerts. Priya does not need a lab. She needs to find out what the downloaded file installed, whether any food bank account is at risk, and how to make the laptop safe again, in a way Ana can check afterwards. ### 1.2 Five words to know **Malware** is software made to cause harm, such as stealing data or showing fake alerts. An **artefact** is any trace on a computer: a file, a log line, a startup entry. **Evidence** is an artefact you have collected carefully so you can show it was not changed. A **hash** is a short fingerprint calculated from a file; if one byte changes, the fingerprint changes. An **incident** is an event that harms or threatens systems or data. In the course case, FreeTemplates_setup.exe is the malware, and TemplateUpdater in the startup list is an artefact. Priya's saved copy of the startup list becomes evidence once its date and source are written down. ### 1.3 The course case **Tomás Reyes** volunteers at the fictional **Riverside Food Bank**. On a Tuesday he downloads a "free invoice template" from an advert. Soon, pop-ups claim the laptop is infected and urge him to phone a number. He tells **Priya Nair**, the food bank's volunteer IT coordinator. The pop-ups are a known trick: the program wants Tomás to phone a fake support line, where someone may ask for payment or for remote access to the laptop. Tomás did the right thing by telling someone instead of calling. The question for Priya is what the template file put on the laptop, and whether anything beyond the laptop is affected, such as the food bank's email or donations account. ### 1.4 First decisions Priya's first decisions are simple: do not phone the number; do not pay anything; stop using the laptop for food bank work; disconnect it from Wi-Fi; write down what is seen and when. She does not delete files yet, because they may tell her what happened. Disconnecting from Wi-Fi stops the laptop from talking to the internet, so a program on it cannot download more files or send data out. Leaving it switched on but disconnected keeps the pop-ups visible for her notes. Her first note records all of this: report at 14:20, laptop disconnected at 14:25, Ana's permission at 14:30, no calls made and nothing paid. ### 1.5 Why not just wipe it? Wiping removes the problem but also the answers: what was installed, whether passwords were taken, whether other machines are affected. A few careful steps first make the fix safer. For FB-LAP-02, those first steps answered the main worry. The hash check identified the file as known adware, the startup list showed two new programs, and the email sign-in history showed only Tomás's usual sign-ins. With those answers written down, Priya and Ana could restore the laptop on Thursday knowing what they were removing, and knowing that the food bank's email did not need further work beyond a new password and two-step sign-in. ### 1.6 Who decides The food bank's coordinator owns the laptop. Priya asks her permission before examining it. Ana owns the decisions, not just the laptop. She decides what Priya may examine, whether Tomás's food bank email may be checked, whether the laptop is restored or cleaned, and whether anyone outside the food bank must be told. Priya's job is to give Ana clear facts and options. When Priya later needs to look at the email account, she goes back to Ana rather than deciding for herself, and Ana's answer is added to the scope in writing. ### 1.7 Keeping notes Every step goes in a notebook with the time. Write down the time, what you did, what you saw, and where it came from, in words someone else can follow. Priya's first note does this: "Tue 14:20 — Tomás reports pop-ups after downloading 'FreeTemplates_setup.exe' at about 13:50." Later, the browser history gave the exact download time, 13:48, and her notes show both the first report and the later, checked time. A good note never changes old entries; it adds new ones. ### Worked example The next lines of Priya's first note read: "Laptop FB-LAP-02 disconnected from Wi-Fi 14:25. Coordinator Ana gave permission to examine 14:30. No calls made, nothing paid." > **Synthetic case.** Riverside Food Bank, the laptop and all people are invented. ### Errors and limits Fake alerts are designed to scare; calm, written steps work better than speed. ### Exercises - **EX001 — Forensics in a sentence.** Explain digital forensics in one plain sentence. *Rubric:* 3 = finding what happened on computers in a checkable way; 2 = partial; 1 = hacking; 0 = none. - **EX002 — Malware analysis.** What question does malware analysis answer? *Rubric:* 3 = what a suspicious program does; 2 = partial; 1 = who wrote it; 0 = none. - **EX003 — Define malware.** Give a definition of malware with one example of harm. *Rubric:* 3 = harmful software plus example (theft, fake alerts); 2 = definition only; 1 = any program; 0 = none. - **EX004 — Artefact.** Name three kinds of artefact. *Rubric:* 3 = file, log line, startup entry (any three traces); 2 = two; 1 = one; 0 = none. - **EX005 — Evidence versus artefact.** What turns an artefact into evidence? *Rubric:* 3 = careful collection showing it was not changed; 2 = partial; 1 = vague; 0 = none. - **EX006 — Hash.** Describe what a hash does. *Rubric:* 3 = fingerprint of a file; changes if any byte changes; 2 = partial; 1 = password; 0 = none. - **EX007 — Incident.** Is Tomás's situation an incident? Explain. *Rubric:* 3 = yes; threatens laptop and data; 2 = yes only; 1 = no; 0 = none. - **EX008 — Response phases.** List the incident response phases. *Rubric:* 3 = prepare, detect/analyse, contain/recover, lessons; 2 = three; 1 = one; 0 = none. - **EX009 — Do not call.** Why should Tomás not phone the number? *Rubric:* 3 = fake alert scam; callers ask for money or remote access; 2 = partial; 1 = fine to call; 0 = none. - **EX010 — Disconnect.** What does disconnecting from Wi-Fi achieve? *Rubric:* 3 = stops communication and spread while keeping evidence; 2 = partial; 1 = vague; 0 = none. - **EX011 — Wipe now?** Give one reason not to wipe straight away. *Rubric:* 3 = lose answers about what happened, passwords, other machines; 2 = partial; 1 = wipe now; 0 = none. - **EX012 — Permission.** Whose permission did Priya need, and why? *Rubric:* 3 = coordinator Ana, owner of laptop; 2 = name only; 1 = vague; 0 = none. - **EX013 — First note.** List four details in Priya's first note. *Rubric:* 3 = report time, file name, disconnect time, permission, no calls/payment (four); 2 = three; 1 = one; 0 = none. ### Synthesis Understand the basic words, decide calmly, keep evidence and write down every step. ### Continue studying — lesson 01 (chapter 01 of 20) [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 →](#ch-02) ## Worked answers **EX001.** It is the careful study of computers and accounts to find out what happened, done so others can check the work. **EX002.** What a suspicious program actually does. **EX003.** Software designed to cause harm, for example by stealing passwords or showing fake virus alerts. **EX004.** A file, a log line and a startup entry. **EX005.** Collecting it carefully and recording it so you can show it has not been changed. **EX006.** It computes a short fingerprint from a file; changing even one byte gives a different fingerprint. **EX007.** Yes, because a harmful program threatens the laptop and the food bank's data. **EX008.** Prepare; detect and analyse; contain and recover; learn lessons. **EX009.** The pop-up is a scam, and the people on the phone usually ask for payment or remote control of the laptop. **EX010.** It stops the laptop talking to the internet or spreading, while leaving its contents in place to examine. **EX011.** Wiping destroys the traces that show what was installed, whether passwords were taken and whether other devices are at risk. **EX012.** Ana, the coordinator, because the food bank owns the laptop. **EX013.** When Tomás reported it, the file name, when Wi-Fi was disconnected and when Ana gave permission (and that no calls or payments were made).