Chapter 3 — Digital forensics and malware analysis: systems, data and dependencies
Lesson map
Lesson 03 published. Map, example, EX027.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Where traces live"]
N2["3.2 Finding the file"]
N3["3.3 Identifying by hash"]
N4["Lab — checking hashes"]
N5["3.4 Reading the result"]
N6["3.5 Dependencies"]
N7["3.6 Checking the email"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX027"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Where traces live"]
N2["3.2 Finding the file"]
N3["3.3 Identifying by hash"]
N4["Lab — checking hashes"]
N5["3.4 Reading the result"]
N6["3.5 Dependencies"]
N7["3.6 Checking the email"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX027"]
[Learning outcomes]
|
v
[3.1 Where traces live]
|
v
[3.2 Finding the file]
|
v
[3.3 Identifying by hash]
|
v
[Lab — checking hashes]
|
v
[3.4 Reading the result]
|
v
[3.5 Dependencies]
|
v
[3.6 Checking the email]
|
v
[Worked example] --> [Exercise EX027]
Learning outcomes
You will (1) find where useful traces live on a laptop; (2) use hashes to identify known files; (3) understand how accounts and services depend on each other; (4) record findings with sources.
3.1 Where traces live
On a laptop: the downloads folder, the list of installed programs, startup entries (programs that run at sign-in), browser history and security logs. Each answers part of the question.
In this case, Downloads showed the installer and its time; the browser history showed the advert page visited just before; and the startup list showed what the installer added. Security logs could show whether anything tried to sign in with stolen passwords. No single place gives the full story, which is why Priya checks several and writes down which place each fact came from.
3.2 Finding the file
In Downloads, Priya finds FreeTemplates_setup.exe, downloaded at 13:48. The browser history shows the advert page just before.
Two times fit together here: the advert page at 13:46 and the download at 13:48. Tomás remembered "about 13:50", which is close but not exact; the file's own time is more reliable than memory. Priya does not open or run the file. She only notes its name, its folder and its time, then moves to the hash check.
The two-minute gap fits a click on the advert followed by a download. A gap of an hour would have suggested that something else, such as another site, delivered the file.
3.3 Identifying by hash
Instead of running the file, she calculates its hash and compares it with a list of known bad files. Kornblum (2006) and others describe how hashes help sort known from unknown files.
The lab shows how: the script calculates each file's SHA-256 fingerprint and looks for it in a short known-bad list. Only FreeTemplates_setup.exe matches. The file never has to run, so the check is safe. In real work the list would come from a trusted source, and Priya would record which version of the list she used, as her note does with "list v1".
Lab — checking hashes
"""Compare SHA-256 hashes of synthetic files with a synthetic known-bad list."""
import hashlib
files = {
"budget.xlsx": b"synthetic spreadsheet bytes",
"FreeTemplates_setup.exe": b"synthetic installer bytes - not a real program",
"photo.jpg": b"synthetic photo bytes",
}
known_bad = {hashlib.sha256(b"synthetic installer bytes - not a real program").hexdigest(): "Fake-template adware (synthetic)"}
for name, data in files.items():
h = hashlib.sha256(data).hexdigest()
print(f"{name:25} {h[:12]} {known_bad.get(h, 'no match')}")
Run with python3 lab_hashcheck.py. Verified output:
budget.xlsx 0edf30e2fa30 no match
FreeTemplates_setup.exe 3e5d3b83407c Fake-template adware (synthetic)
photo.jpg ffcab6e8630a no match
3.4 Reading the result
budget.xlsx and photo.jpg have no match. FreeTemplates_setup.exe matches "Fake-template adware" in the synthetic list. A match identifies a known file; no match does not prove a file is safe.
Both files could still be harmful, but nothing else points to them: they were not downloaded with the installer, and they did not add startup programs. Priya records them as checked, with no match, and moves on. She does not write "clean". A known-bad list only covers files that were reported before it was last updated, so she also writes the date of the list next to the results.
3.5 Dependencies
The laptop's browser holds a saved password for the food bank email. The email is used to reset the online donations account. So a problem on one laptop could reach the email and then donations. Mapping such links shows what else to check.
This chain is why Ana widened the scope to the email account. Priya also notes the donations account as the next link: if the email had shown strange sign-ins, she would have asked Ana to check the donations account's recent activity and password reset history too.
3.6 Checking the email
Within the widened scope, the email sign-in history shows only Tomás's usual sign-ins. Priya changes the password anyway, from a clean computer, and turns on two-step sign-in.
She changes the password from a clean computer because the laptop might still have a program that records what is typed. A new password typed on FB-LAP-02 could be captured at once. Two-step sign-in means a stolen password alone is not enough to get into the email. Her note records the time: 15:10 on Wednesday. Tomás is told not to save the new password in the laptop's browser.
3.7 Recording
Each finding is written with where it came from.
Priya's Wednesday note shows the pattern: the installer "in Downloads, 13:48"; the hash match "known adware (list v1)"; the advert page from "browser history 13:46"; and the email sign-ins checked and found normal. Each fact names its source. If Ana or a professional later doubts one of them, they know where to look again. A finding with no source can only be trusted on Priya's word, and a careful note means nobody has to rely on that.
Worked example
Priya's note: "FreeTemplates_setup.exe in Downloads, 13:48; hash matches known adware (list v1); browser history shows advert page 13:46. Email sign-ins normal; password changed from clean PC 15:10 Wed; two-step on."
Synthetic case. Files and hashes come from the lab script.
Errors and limits
Known-bad lists miss new or changed files; use hashes as one clue among several.
Exercises
- EX027 — Trace locations. Name four places traces live on a laptop. Rubric: 3 = downloads, installed programs, startup entries, browser history, logs (four); 2 = three; 1 = one; 0 = none.
- EX028 — Download time. When was the file downloaded, and what came just before? Rubric: 3 = 13:48; advert page 13:46; 2 = one; 1 = wrong; 0 = none.
- EX029 — Hash not run. Why compare hashes instead of running the file? Rubric: 3 = identifies safely without harm; 2 = partial; 1 = faster; 0 = none.
- EX030 — Hash lab. Which file matched, and as what? Rubric: 3 = FreeTemplates_setup.exe, fake-template adware; 2 = file only; 1 = wrong; 0 = none.
- EX031 — No match. Does "no match" mean safe? Rubric: 3 = no; new/changed files not on list; 2 = no only; 1 = yes; 0 = none.
- EX032 — Dependency chain. Explain the laptop-to-donations chain. Rubric: 3 = saved email password → email resets donations account; 2 = partial; 1 = vague; 0 = none.
- EX033 — Email check result. What did the sign-in history show? Rubric: 3 = only usual sign-ins; 2 = partial; 1 = attacker; 0 = none.
- EX034 — Clean computer. Why change the password from a clean computer? Rubric: 3 = infected laptop might capture new password; 2 = partial; 1 = no reason; 0 = none.
- EX035 — Two-step. What does two-step sign-in add? Rubric: 3 = second proof beyond password; 2 = partial; 1 = vague; 0 = none.
- EX036 — Source notes. Why write where each finding came from? Rubric: 3 = others can check it; 2 = partial; 1 = habit; 0 = none.
- EX037 — Startup entries. What are startup entries? Rubric: 3 = programs that run automatically at sign-in; 2 = partial; 1 = wrong; 0 = none.
- EX038 — Known lists. State one limit of known-bad lists. Rubric: 3 = miss new or changed files; 2 = partial; 1 = vague; 0 = none.
Synthesis
Know where traces live, identify files safely by hash, follow dependencies and write sources beside findings.
Continue studying — chapter 03 of 04
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →