Chapter 12 — Digital forensics and malware analysis: Contained laboratory I
Lesson map
Lesson 12 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["12.1 The contained lab"]
N2["12.2 Why skew matters"]
N3["Lab — correcting skew"]
N4["12.3 Reading the result"]
N5["12.4 Recording the offset"]
N6["12.5 Checking the correction"]
N7["12.6 Lab safety rules"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 The contained lab"]
N2["12.2 Why skew matters"]
N3["Lab — correcting skew"]
N4["12.3 Reading the result"]
N5["12.4 Recording the offset"]
N6["12.5 Checking the correction"]
N7["12.6 Lab safety rules"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]
[Learning outcomes]
|
v
[12.1 The contained lab]
|
v
[12.2 Why skew matters]
|
v
[Lab — correcting skew]
|
v
[12.3 Reading the result]
|
v
[12.4 Recording the offset]
|
v
[12.5 Checking the correction]
|
v
[12.6 Lab safety rules]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) work in a contained lab with synthetic evidence; (2) correct clock skew in a timeline; (3) reconstruct the order of execution; (4) record lab work to case standard.
12.1 The contained lab
The hospital's training lab is isolated from the clinical network and holds only synthetic copies of artefacts. Nothing in it can reach the internet, and no live samples are present. Exercises use exported records, not malware.
Copies in the lab are synthetic versions of the real exports, prepared so the exercises use the same structure and times without any patient data. Sana works there on the skew correction and the process tree, never on the clinical network. Results from the lab inform the case only after they are checked against the real evidence.
12.2 Why skew matters
WARD4-PC2's clock was found slow during collection. Mixing its local times with proxy times (which are synchronised) would put more than six minutes between the program being written and its first proxy contact, instead of one second — a false gap that could mislead an investigator.
Read raw, the PC's events would appear six minutes before the proxy contact, suggesting a long delay between execution and the first network contact. Corrected, the gap is only seconds, which shows the program contacted its server almost as soon as it was written. Getting the gap right matters because it decides whether the two events are linked. Only WARD4-PC2's own records, its file-system timestamps and local event logs, carry the slow clock; the EDR export was stamped by the EDR server on receipt and is already correct.
Lab — correcting skew
"""Correct a device clock skew before merging with server logs."""
from datetime import datetime, timedelta
skew = timedelta(minutes=-6, seconds=-20) # PC clock is 6m20s slow
# PC-local times (file system, local event log); EDR times are server-stamped and need no correction
pc = [("2026-09-14T09:56:21", "wscript started"), ("2026-09-14T09:56:24", "svch.exe written")]
srv = [("2026-09-14T10:02:45", "proxy: svch.exe contacts update-cdn.example.net")]
rows = [(datetime.fromisoformat(t) - skew, "PC ", e) for t, e in pc] + [(datetime.fromisoformat(t), "SRV", e) for t, e in srv]
for t, s, e in sorted(rows): print(t.time(), s, e)
Run with python3 lab_skew.py. Verified output:
10:02:41 PC wscript started
10:02:44 PC svch.exe written
10:02:45 SRV proxy: svch.exe contacts update-cdn.example.net
12.3 Reading the result
The PC clock was 6 minutes 20 seconds slow, measured by comparing it with a reference time server at collection. After correction, the order is: 10:02:41 script host started from the shortcut, 10:02:44 svch.exe written, 10:02:45 proxy contact. Execution led to contact within four seconds.
The six minutes and twenty seconds come from a single comparison at collection, recorded with the reference used and the time it was taken. Applying the offset to the two PC events puts them four seconds and one second before the proxy contact. Sana applies the same offset to every WARD4-PC2 local time for that day. The corrected 10:02:41 and 10:02:44 match the EDR export times exactly, because the EDR server stamped those events with synchronised UTC on receipt. That agreement is an independent check that the measured offset of six minutes twenty seconds is right.
12.4 Recording the offset
The offset, how it was measured and when are stored in the case notes; corrected times are marked as such, and raw times are kept beside them.
Keeping raw and corrected values side by side lets anyone check the arithmetic or apply a better offset later if one is found. Corrected times carry a mark in every table so they are never mistaken for original records. Owen checks the arithmetic on two events before the corrected timeline is used. The reference time server and the collection time of 11:30 are recorded beside the offset.
12.5 Checking the correction
The server-stamped EDR time for the wscript start agrees with the corrected registry time for the shortcut's last access. The registry time matches only after correction, which supports the offset.
The wscript start in EDR and the shortcut's last-access time in the registry are recorded by different clocks. The EDR server stamped its event with synchronised UTC on receipt, while the registry value was written by WARD4-PC2's slow clock. If the offset were wrong, the corrected registry time would not match the EDR time or sit just before the proxy contact. That it lines up with both after correction supports the offset and the sequence.
12.6 Lab safety rules
No files leave the lab; synthetic data is labelled; lab PCs are reset after each session.
These rules keep synthetic material from being mistaken for case evidence and keep anything from the lab out of the clinical network. Resetting lab PCs after each session means the next student starts from a known state. No real samples are ever brought in, so the lab cannot spread the program even by accident. Any file a student wants to keep must be recreated outside the lab from the original synthetic source.
12.7 Lab notes
Sana's lab notes follow the same format as case notes, so the habit carries over.
Writing lab notes with times, sources, offsets and checks means the habit is already formed when she writes case notes under pressure. Owen reviews lab notes the same way he reviews case notes, so mistakes are found where they cost nothing. The skew note in the worked example follows exactly that format. Sana's lab notes are kept with her course portfolio rather than in the hospital's case system.
Worked example
Sana's note: "WARD4-PC2 clock −6 m 20 s against reference at 11:30 collection. All WARD4-PC2 local times corrected by +6 m 20 s; raw values retained. Corrected sequence: 10:02:41 wscript, 10:02:44 svch.exe write, 10:02:45 proxy." Owen checks the arithmetic on two events.
Synthetic case. Times come from the lab script.
Errors and limits
Skew can drift over time; an offset measured at collection may not hold for events days earlier.
Exercises
- EX045 — Skew size. How large was the skew, and how was it measured? Rubric: 3 = 6 m 20 s slow; compared with reference time server at collection; 2 = size only; 1 = wrong; 0 = none.
- EX046 — Corrected order. Give the corrected order of the three events. Rubric: 3 = 10:02:41 wscript, 10:02:44 svch, 10:02:45 proxy; 2 = order only; 1 = wrong; 0 = none.
- EX047 — Supporting the offset. What supports the offset being right? Rubric: 3 = server-stamped EDR time and corrected registry time agree; 2 = partial; 1 = vague; 0 = none.
- EX048 — Drift. Why might the offset not hold for older events? Rubric: 3 = skew drifts over time; 2 = partial; 1 = fixed; 0 = none.
Synthesis
Measure, record and apply clock offsets carefully, keep raw times, and confirm corrections with independent sources.
Continue studying — chapter 12 of 18
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →