Chapter 1 — Digital forensics and malware analysis: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 What the field is"]
N2["1.2 Five words to know"]
N3["1.3 The course case"]
N4["1.4 First decisions"]
N5["1.5 Why not just wipe it?"]
N6["1.6 Who decides"]
N7["1.7 Keeping notes"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 What the field is"]
N2["1.2 Five words to know"]
N3["1.3 The course case"]
N4["1.4 First decisions"]
N5["1.5 Why not just wipe it?"]
N6["1.6 Who decides"]
N7["1.7 Keeping notes"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 What the field is]
|
v
[1.2 Five words to know]
|
v
[1.3 The course case]
|
v
[1.4 First decisions]
|
v
[1.5 Why not just wipe it?]
|
v
[1.6 Who decides]
|
v
[1.7 Keeping notes]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain in plain words what digital forensics and malware analysis are; (2) define malware, artefact, evidence, hash and incident; (3) describe the first decisions after something looks wrong; (4) meet the course case.
1.1 What the field is
Digital forensics is the careful study of computers and accounts to find out what happened, in a way other people can check. Malware analysis looks at suspicious programs to learn what they do. Both help people respond to incidents: NIST SP 800-61 describes response as preparing, detecting and analysing, containing and recovering, then learning lessons.
In this course the incident is small: one laptop at a food bank showing fake virus alerts. Priya does not need a lab. She needs to find out what the downloaded file installed, whether any food bank account is at risk, and how to make the laptop safe again, in a way Ana can check afterwards.
1.2 Five words to know
Malware is software made to cause harm, such as stealing data or showing fake alerts. An artefact is any trace on a computer: a file, a log line, a startup entry. Evidence is an artefact you have collected carefully so you can show it was not changed. A hash is a short fingerprint calculated from a file; if one byte changes, the fingerprint changes. An incident is an event that harms or threatens systems or data.
In the course case, FreeTemplates_setup.exe is the malware, and TemplateUpdater in the startup list is an artefact. Priya's saved copy of the startup list becomes evidence once its date and source are written down.
1.3 The course case
Tomás Reyes volunteers at the fictional Riverside Food Bank. On a Tuesday he downloads a "free invoice template" from an advert. Soon, pop-ups claim the laptop is infected and urge him to phone a number. He tells Priya Nair, the food bank's volunteer IT coordinator.
The pop-ups are a known trick: the program wants Tomás to phone a fake support line, where someone may ask for payment or for remote access to the laptop. Tomás did the right thing by telling someone instead of calling. The question for Priya is what the template file put on the laptop, and whether anything beyond the laptop is affected, such as the food bank's email or donations account.
1.4 First decisions
Priya's first decisions are simple: do not phone the number; do not pay anything; stop using the laptop for food bank work; disconnect it from Wi-Fi; write down what is seen and when. She does not delete files yet, because they may tell her what happened.
Disconnecting from Wi-Fi stops the laptop from talking to the internet, so a program on it cannot download more files or send data out. Leaving it switched on but disconnected keeps the pop-ups visible for her notes. Her first note records all of this: report at 14:20, laptop disconnected at 14:25, Ana's permission at 14:30, no calls made and nothing paid.
1.5 Why not just wipe it?
Wiping removes the problem but also the answers: what was installed, whether passwords were taken, whether other machines are affected. A few careful steps first make the fix safer.
For FB-LAP-02, those first steps answered the main worry. The hash check identified the file as known adware, the startup list showed two new programs, and the email sign-in history showed only Tomás's usual sign-ins. With those answers written down, Priya and Ana could restore the laptop on Thursday knowing what they were removing, and knowing that the food bank's email did not need further work beyond a new password and two-step sign-in.
1.6 Who decides
The food bank's coordinator owns the laptop. Priya asks her permission before examining it.
Ana owns the decisions, not just the laptop. She decides what Priya may examine, whether Tomás's food bank email may be checked, whether the laptop is restored or cleaned, and whether anyone outside the food bank must be told. Priya's job is to give Ana clear facts and options. When Priya later needs to look at the email account, she goes back to Ana rather than deciding for herself, and Ana's answer is added to the scope in writing.
1.7 Keeping notes
Every step goes in a notebook with the time.
Write down the time, what you did, what you saw, and where it came from, in words someone else can follow. Priya's first note does this: "Tue 14:20 — Tomás reports pop-ups after downloading 'FreeTemplates_setup.exe' at about 13:50." Later, the browser history gave the exact download time, 13:48, and her notes show both the first report and the later, checked time. A good note never changes old entries; it adds new ones.
Worked example
The next lines of Priya's first note read: "Laptop FB-LAP-02 disconnected from Wi-Fi 14:25. Coordinator Ana gave permission to examine 14:30. No calls made, nothing paid."
Synthetic case. Riverside Food Bank, the laptop and all people are invented.
Errors and limits
Fake alerts are designed to scare; calm, written steps work better than speed.
Exercises
- EX001 — Forensics in a sentence. Explain digital forensics in one plain sentence. Rubric: 3 = finding what happened on computers in a checkable way; 2 = partial; 1 = hacking; 0 = none.
- EX002 — Malware analysis. What question does malware analysis answer? Rubric: 3 = what a suspicious program does; 2 = partial; 1 = who wrote it; 0 = none.
- EX003 — Define malware. Give a definition of malware with one example of harm. Rubric: 3 = harmful software plus example (theft, fake alerts); 2 = definition only; 1 = any program; 0 = none.
- EX004 — Artefact. Name three kinds of artefact. Rubric: 3 = file, log line, startup entry (any three traces); 2 = two; 1 = one; 0 = none.
- EX005 — Evidence versus artefact. What turns an artefact into evidence? Rubric: 3 = careful collection showing it was not changed; 2 = partial; 1 = vague; 0 = none.
- EX006 — Hash. Describe what a hash does. Rubric: 3 = fingerprint of a file; changes if any byte changes; 2 = partial; 1 = password; 0 = none.
- EX007 — Incident. Is Tomás's situation an incident? Explain. Rubric: 3 = yes; threatens laptop and data; 2 = yes only; 1 = no; 0 = none.
- EX008 — Response phases. List the incident response phases. Rubric: 3 = prepare, detect/analyse, contain/recover, lessons; 2 = three; 1 = one; 0 = none.
- EX009 — Do not call. Why should Tomás not phone the number? Rubric: 3 = fake alert scam; callers ask for money or remote access; 2 = partial; 1 = fine to call; 0 = none.
- EX010 — Disconnect. What does disconnecting from Wi-Fi achieve? Rubric: 3 = stops communication and spread while keeping evidence; 2 = partial; 1 = vague; 0 = none.
- EX011 — Wipe now? Give one reason not to wipe straight away. Rubric: 3 = lose answers about what happened, passwords, other machines; 2 = partial; 1 = wipe now; 0 = none.
- EX012 — Permission. Whose permission did Priya need, and why? Rubric: 3 = coordinator Ana, owner of laptop; 2 = name only; 1 = vague; 0 = none.
- EX013 — First note. List four details in Priya's first note. Rubric: 3 = report time, file name, disconnect time, permission, no calls/payment (four); 2 = three; 1 = one; 0 = none.
Synthesis
Understand the basic words, decide calmly, keep evidence and write down every step.