Chapter 18 — Digital forensics and malware analysis: Supervised technical project
Lesson map
Lesson 18 published. Map, example, EX069.
flowchart TD
N0["Learning outcomes"]
N1["18.1 The project"]
N2["18.2 Case file contents"]
N3["18.3 Findings summary"]
N4["18.4 Recommendations"]
N5["18.5 Presenting"]
N6["18.6 Supervision"]
N7["18.7 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX069"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 The project"]
N2["18.2 Case file contents"]
N3["18.3 Findings summary"]
N4["18.4 Recommendations"]
N5["18.5 Presenting"]
N6["18.6 Supervision"]
N7["18.7 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]
[Learning outcomes]
|
v
[18.1 The project]
|
v
[18.2 Case file contents]
|
v
[18.3 Findings summary]
|
v
[18.4 Recommendations]
|
v
[18.5 Presenting]
|
v
[18.6 Supervision]
|
v
[18.7 Reflection]
|
v
[Worked example] --> [Exercise EX069]
Learning outcomes
You will (1) complete a supervised technical project end to end; (2) assemble a case file; (3) present findings to technical and non-technical audiences; (4) reflect on your practice.
18.1 The project
Sana's final project for Harbour Technical College is the full case file for the Ward 4 USB incident, supervised by Owen, using only synthetic copies approved for the course.
The project uses synthetic copies so that the course work contains no patient or staff data from the real incident. Owen supervises the project as he supervised the case, reviewing each part against the course rubric. The case file shows that Sana can carry an incident from first alert to final report.
18.2 Case file contents
Authorisation; scope; collection logs; manifests and verification tables; timeline with clock corrections; USB movement table; process tree; analyst report summary; control changes with test results; lessons learned; references.
Each item is a record produced during the case, not something written afterwards for the project. The list follows the order an investigation happens in, from authority to lessons learned. A reviewer can check any finding by following it back through the timeline and verification tables to the collection logs. Every record in the file carries the synthetic label required for course submission.
18.3 Findings summary
The rota stick SN-7731, edited on a home PC, carried a malicious shortcut. On WARD2-PC1 the pilot application control blocked it. On WARD4-PC2 and PHARM-PC3 it ran a script that dropped a remote-access tool, which contacted update-cdn.example.net. EDR containment stopped activity at 10:09 on WARD4-PC2; PHARM-PC3 was contained at 11:31. No lateral connections between hosts were found; spread was by the stick.
Each sentence in the summary traces to a specific record: the USB table, the application control block event, the filtering lab, the proxy log and the containment times. No lateral connections were found by the internal firewall search. The summary says 'no connections were found' rather than 'there were none', because the firewall logs only the traffic it sees.
18.4 Recommendations
Application control on all wards; block scripts from removable media; rota on the intranet; proxy and DHCP retention to policy; log store replica.
Each recommendation answers a finding: application control and script blocking stop the Ward 4 sequence, and the intranet rota removes the stick's purpose. The retention and replica items close the gaps found in the logs. The board summary gives each one a cost and an owner, so the board can decide. The replica item cites change 2291, requested when the dependency map was drawn, so the board can see it is already under way.
18.5 Presenting
To the IT board: one page with impact, cause, actions and costs. To the security team: the full file. To ward managers: what happened and what changes for staff.
The board gets impact, cause and cost because it decides budgets; the security team gets the full file because it may need to repeat the work. Ward managers get what changes for their staff, such as using the intranet for rotas. Each version is drawn from the same case file, so the numbers agree.
18.6 Supervision
Owen reviews each section before submission and records his assessment against the course rubric.
His review covers accuracy, completeness and whether every finding is supported by a record in the file. Comments are made in writing so Sana can show how each was addressed. His assessment against the course rubric is recorded separately from his comments, so the college can see both. Owen's review notes are kept in the case file with Sana's responses to each comment. Those responses show which comments led to a change in the file and which she answered with a reason instead.
18.7 Reflection
Sana notes what she would do differently: ask the clock question at the very start of collection, and lock the evidence folder before analysis begins.
Asking about the clock at the start would have avoided the confusion of merging raw PC times with server times. Locking the folder earlier would have prevented the usb_log.csv mismatch. Both lessons go into the runbook, so the next operator benefits without repeating the mistake. She also notes that querying by event time from the start would have avoided the PHARM-PC3 gap question.
Worked example
At the board, a member asks whether patient data left the hospital. Sana answers: "The tool contacted one external domain for under seven minutes on WARD4-PC2 and fifteen on PHARM-PC3. Proxy logs show only small transfers, consistent with check-ins. We cannot rule out data loss completely, so the data protection officer has been informed."
Synthetic case. The project and answers are invented.
Errors and limits
A project done after the fact benefits from hindsight; real-time decisions were harder.
Exercises
- EX069 — Case file. List six items in the case file. Rubric: 3 = six of the listed items; 2 = four; 1 = two; 0 = none.
- EX070 — Findings. Summarise how the infection spread. Rubric: 3 = by stick SN-7731; blocked Ward 2; ran Ward 4 and pharmacy; no lateral; 2 = partial; 1 = network worm; 0 = none.
- EX071 — Audiences. How was the presentation adapted for three audiences? Rubric: 3 = board one page; security full file; ward managers staff changes; 2 = two; 1 = one; 0 = none.
- EX072 — Data loss answer. How did Sana answer the data loss question? Rubric: 3 = short contact, small transfers, cannot rule out, DPO informed; 2 = partial; 1 = "no loss"; 0 = none.
Synthesis
A supervised project brings the course together: complete records, clear findings, honest limits and audience-fitted reporting.
Continue studying — chapter 18 of 18
← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →