Chapter 4 — Digital forensics and malware analysis: guided lab and applied synthesis
Lesson map
Lesson 04 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Baselines"]
N2["Lab — startup programs against baseline"]
N3["4.2 Reading the result"]
N4["4.3 Deciding on clean-up"]
N5["4.4 Before restoring"]
N6["4.5 The report"]
N7["4.6 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Baselines"]
N2["Lab — startup programs against baseline"]
N3["4.2 Reading the result"]
N4["4.3 Deciding on clean-up"]
N5["4.4 Before restoring"]
N6["4.5 The report"]
N7["4.6 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[4.1 Baselines]
|
v
[Lab — startup programs against baseline]
|
v
[4.2 Reading the result]
|
v
[4.3 Deciding on clean-up]
|
v
[4.4 Before restoring]
|
v
[4.5 The report]
|
v
[4.6 Lessons]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) compare a system against a baseline in a guided lab; (2) decide on clean-up with evidence; (3) write a short report; (4) list lessons and next steps.
4.1 Baselines
A baseline is a record of what normal looks like. Priya saved a list of startup programs when the food bank laptops were set up. Comparing today's list with it shows what changed.
The baseline only helps because it was saved before the problem. For FB-LAP-02 it listed three startup programs: OneDrive, AudioService and PrinterHelper. Without it, Priya would see five programs and have to judge each name by guessing; with it, the lab prints the two that are new, and her attention goes straight to them.
Lab — startup programs against baseline
"""Compare a synthetic list of startup programs with a saved baseline."""
baseline = {"OneDrive", "AudioService", "PrinterHelper"}
today = {"OneDrive", "AudioService", "PrinterHelper", "TemplateUpdater", "AlertPopup"}
print("baseline:", len(baseline), "today:", len(today))
for name in sorted(today - baseline):
print("NEW:", name)
for name in sorted(baseline - today):
print("MISSING:", name)
Run with python3 lab_startup.py. Verified output:
baseline: 3 today: 5
NEW: AlertPopup
NEW: TemplateUpdater
4.2 Reading the result
Three baseline programs are still present. Two are new: TemplateUpdater and AlertPopup. Their names and timing match the template download, and AlertPopup explains the fake alerts.
The lab also prints nothing under MISSING, which tells Priya that none of the three normal programs was removed or replaced. That matters: some harmful programs disable or replace normal ones. Her note records the two new names, the time they appeared, and that they fit the download at 13:48. She does not open them; their names and timing are enough to decide what to do next.
4.3 Deciding on clean-up
Evidence so far: a known adware installer, two new startup programs, no sign of email misuse. Because the laptop is small and backed up, Priya and Ana decide to restore it from the clean setup image rather than remove items one by one; removal might miss something.
Restoring from the clean image takes the laptop back to its known setup. It also removes anything the startup list did not show. The decision is Ana's, made with Priya's facts in front of her. Tomás's documents are safe because they are in the shared drive, not only on the laptop.
4.4 Before restoring
Priya copies her notes, the hash results and the startup comparison to a USB stick, and Tomás confirms his documents are in the shared drive.
Once the laptop is restored, the old disk contents are gone, so anything not saved now is lost for good. Priya saves her own records, not the suspicious installer: the notes, the three hash results and the startup comparison showing TemplateUpdater and AlertPopup. If the same adware appears on another food bank laptop, these records show what to look for. Priya labels the USB stick with the case date and keeps it locked away with the scope page.
4.5 The report
A one-page report: what happened, when, what was found, what was done, and what will change. Plain words for volunteers.
Priya's report fits on one page: on Tuesday at 13:48 a fake template installer was downloaded from an advert; it added two startup programs, including one that showed fake virus alerts; no email misuse was found; the laptop was restored on Thursday from the clean image; the email password was changed and two-step sign-in enabled. It ends with the changes: standard accounts for volunteers and a list of approved template sites.
4.6 Lessons
Download templates only from known sites; use a standard account without admin rights; keep the startup baseline current; report pop-ups early, as Tomás did.
Each lesson comes from a fact in this case. Templates from known sites, because the installer came from an advert. A standard account without admin rights, because that would likely have stopped the installer from adding startup programs. A current baseline, because the saved startup list made the new programs easy to spot. Early reporting, because Tomás's quick message meant the laptop was off Wi-Fi within minutes of his report.
4.7 Next steps for learners
This course gives a first, guided taste. Further courses add evidence handling, timelines and supervised casework.
In this course, Priya hashed files without running them, compared startup programs with a baseline, and widened scope only with Ana's written agreement. Later courses build on each step: evidence copies with their own hashes, timelines that combine browser history and system logs, and casework supervised by an experienced examiner.
Each of those later steps still starts where Priya started: with written permission, a clear question and notes that someone else can check.
Worked example
Priya's report: "Tue 13:48 a fake template installer was downloaded from an advert. It added two startup programs, including one that showed fake virus alerts. No email misuse found. The laptop was restored on Thursday from the clean image; the email password was changed and two-step sign-in enabled. Changes: standard accounts for volunteers; a list of approved template sites."
Synthetic case. The lab data and report are invented.
Errors and limits
A baseline helps only if it is up to date; old baselines flag normal updates as new.
Exercises
- EX039 — Baseline meaning. Define a baseline. Rubric: 3 = record of normal state for comparison; 2 = partial; 1 = backup; 0 = none.
- EX040 — Lab result. Which entries were new? Rubric: 3 = TemplateUpdater and AlertPopup; 2 = one; 1 = wrong; 0 = none.
- EX041 — Pop-up cause. Which entry explains the pop-ups? Rubric: 3 = AlertPopup; 2 = guess with reason; 1 = wrong; 0 = none.
- EX042 — Restore versus remove. Why restore rather than remove items? Rubric: 3 = removal may miss something; laptop backed up and simple; 2 = partial; 1 = faster; 0 = none.
- EX043 — Before restoring. What was saved before restoring? Rubric: 3 = notes, hash results, comparison; documents confirmed in shared drive; 2 = partial; 1 = vague; 0 = none.
- EX044 — Evidence summary. Summarise the evidence for the decision. Rubric: 3 = known adware hash, two new startup entries, no email misuse; 2 = two; 1 = one; 0 = none.
- EX045 — Report audience. Who is the report for, and how is it written? Rubric: 3 = volunteers; plain words, one page; 2 = partial; 1 = technical; 0 = none.
- EX046 — Report parts. List the parts of the report. Rubric: 3 = what, when, found, done, changes; 2 = three; 1 = one; 0 = none.
- EX047 — Lessons. Give three lessons. Rubric: 3 = known sites, standard accounts, current baseline, early reporting (three); 2 = two; 1 = one; 0 = none.
- EX048 — Admin rights. How do standard accounts help? Rubric: 3 = installers cannot add startup programs without admin approval; 2 = partial; 1 = vague; 0 = none.
- EX049 — Old baseline. What happens with an old baseline? Rubric: 3 = normal updates appear as new; false alarms; 2 = partial; 1 = vague; 0 = none.
- EX050 — Tomás's part. What did Tomás do well? Rubric: 3 = reported quickly; did not call or pay; 2 = one; 1 = vague; 0 = none.
Synthesis
Compare against a baseline, decide clean-up from evidence, report plainly and turn lessons into changes.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →