Chapter 5 — Security scope and evidence | Technical Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Scope and authority"]
  N2["5.2 Evidence principles"]
  N3["5.3 Patient data"]
  N4["5.4 The USB stick"]
  N5["5.5 Chain of custody"]
  N6["5.6 Proportionality"]
  N7["5.7 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Scope and authority"]
  N2["5.2 Evidence principles"]
  N3["5.3 Patient data"]
  N4["5.4 The USB stick"]
  N5["5.5 Chain of custody"]
  N6["5.6 Proportionality"]
  N7["5.7 Documentation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Scope and authority]
    |
    v
[5.2 Evidence principles]
    |
    v
[5.3 Patient data]
    |
    v
[5.4 The USB stick]
    |
    v
[5.5 Chain of custody]
    |
    v
[5.6 Proportionality]
    |
    v
[5.7 Documentation]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of an operator's investigative work; (2) apply evidence principles to collection; (3) handle patient data carefully; (4) maintain chain of custody.

5.1 Scope and authority

The hospital's security policy authorises IT security to investigate hospital systems. Operators act under Owen's instruction. Personal devices, including the USB stick if privately owned, need the owner's consent or other authority before examination.

Sana's authority comes through Owen, so she does not start new collection on her own initiative, even when it seems obviously useful. The question of who owned the stick had to be settled before anything on it was examined, because a privately owned stick would need consent. The ward manager's answer that it belonged to the ward settled it.

5.2 Evidence principles

ISO/IEC 27037 describes principles for handling digital evidence: relevance, reliability and sufficiency, with auditability, repeatability, reproducibility and justifiability of methods. For Sana, that means documented actions, verified copies and reasons for each step.

In practice each principle shows up in a specific record: the collection log shows auditability, the manifest and verification table show repeatability, and the reasons written beside each step show justifiability. Owen repeating two findings from Sana's notes is a test of reproducibility. These records are what make her evidence usable if the case ever goes beyond the hospital.

5.3 Patient data

Ward PCs may display or cache patient information. Collection focuses on system artefacts; any patient data encountered are not reviewed beyond necessity and are protected in storage. The data protection officer is informed if patient data might be affected.

WARD4-PC2 could hold cached medication records, so Sana's triage collection targets system artefacts such as event logs, registry hives and startup folders rather than user documents. She does not open patient files to look for malware, and she keeps no screenshots of clinical screens. The data protection officer was informed because the remote-access tool might have reached patient data.

5.4 The USB stick

The nurse says the stick belongs to the ward and was used to share rotas. With the ward manager's agreement it is bagged, labelled and logged as evidence item WB-USB-01.

The bag is sealed and the label records item ID WB-USB-01, a description, the date, Sana's name and the case reference. The stick is not plugged into any PC after collection, because doing so could run the same shortcut again. Its serial number, SN-7731, comes from the PCs' records rather than from examining the stick itself.

5.5 Chain of custody

Each transfer of WB-USB-01 and every data export is recorded: who, when, where, why.

When Sana hands WB-USB-01 to Owen to lock in the security office safe, both sign the custody record with the time and the reason. Data exports receive the same treatment: each EDR, proxy and DHCP export has a line naming who exported it, when and where it was stored. A gap in the record would let anyone question whether an item had been changed. The custody record for WB-USB-01 travels with the bag whenever the stick leaves the safe.

5.6 Proportionality

Only what answers the questions is collected.

For the file share, that meant access logs for WARD4-PC2 and PHARM-PC3 and files written by the ward account, not an image of the whole share. Collecting less also means exposing less patient data and having less to store, verify and eventually destroy. The reason for each scope choice is written down so the scope can be widened if needed. For the ward PCs, collection covered memory, event logs, registry hives and startup folders, not user documents or clinical files.

5.7 Documentation

The ticket links to custody records and collection logs.

The ticket links rather than copies, so there is one authoritative custody record for each item and no duplicate versions that might disagree. A reader can move from a finding in the ticket to the collection log that produced it and the custody record for the item. Owen uses those links when he countersigns the collection logs. Collection logs for both PCs, including PHARM-PC3's 11:42 memory capture, are linked from the same ticket.

Labelling evidence

Each item label carries the item ID, description, date, collector's name and case reference. Sana photographs the stick in its bag with the label visible and attaches the photo to the custody record.

Worked example

Owen asks whether to image the whole hospital file share "just in case". Sana suggests targeted collection: the share's access logs for WARD4-PC2 and PHARM-PC3 during the incident window, plus any files written by the ward account. Owen agrees: it answers the question with far less patient data.

Synthetic case. The decisions are invented.

Errors and limits

Over-narrow collection can miss evidence; record why scope was chosen so it can be widened if needed.

Exercises

EX017 — Stick authority. Why confirm who owns the USB stick? Rubric: 3 = private device needs consent/authority; ward-owned allows; 2 = partial; 1 = no need; 0 = none.
EX018 — Evidence principles. Name three ISO/IEC 27037 method qualities. Rubric: 3 = auditability, repeatability, reproducibility, justifiability (any three); 2 = two; 1 = one; 0 = none.
EX019 — Patient data. How are patient data handled during collection? Rubric: 3 = not reviewed beyond need; protected; DPO informed if affected; 2 = partial; 1 = reviewed; 0 = none.
EX020 — File share choice. Why targeted collection instead of imaging the share? Rubric: 3 = answers question with less patient data; proportionate; 2 = partial; 1 = cheaper; 0 = none.

Synthesis

Act within authority, follow evidence principles, protect patient data and keep custody records.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →