Chapter 6 — Digital forensics and malware analysis: system model
Lesson map
Lesson 06 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["6.1 The model"]
N2["6.2 Spread hypotheses"]
N3["6.3 Evidence per hypothesis"]
N4["6.4 Early results"]
N5["6.5 Updating"]
N6["6.6 Sharing"]
N7["Using the model for questions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 The model"]
N2["6.2 Spread hypotheses"]
N3["6.3 Evidence per hypothesis"]
N4["6.4 Early results"]
N5["6.5 Updating"]
N6["6.6 Sharing"]
N7["Using the model for questions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[6.1 The model]
|
v
[6.2 Spread hypotheses]
|
v
[6.3 Evidence per hypothesis]
|
v
[6.4 Early results]
|
v
[6.5 Updating]
|
v
[6.6 Sharing]
|
v
[Using the model for questions]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) model the incident's systems and connections; (2) list hypotheses about spread; (3) map evidence sources to each hypothesis; (4) update the model as evidence arrives.
6.1 The model
Nodes: WB-USB-01, WARD4-PC2, PHARM-PC3, WARD2-PC1, the proxy, the EDR console, the file share, update-cdn.example.net. Edges: USB connections, network flows, file share access.
Drawing the model makes Sana list systems she might otherwise forget, such as the file share and the external domain. WARD2-PC1 joined the model only after USB records showed the stick there the day before. Each edge records its evidence source, such as USB records for stick connections and proxy logs for the domain.
6.2 Spread hypotheses
H1: the USB stick carried the malware to each PC. H2: WARD4-PC2 infected PHARM-PC3 over the network. H3: both were infected independently from the internet.
Each hypothesis predicts different evidence, which is what makes them testable rather than guesses. H1 predicts the stick's serial on every infected PC, H2 predicts internal connections between the PCs, and H3 predicts separate downloads or emails on each. Writing all three before looking prevents Sana from settling on the first explanation that fits.
6.3 Evidence per hypothesis
H1: USB connection records on each PC with the stick's serial. H2: internal firewall and EDR network events from WARD4-PC2 to PHARM-PC3. H3: proxy or email records of separate downloads.
The mapping also shows which sources have to be collected, which turns the hypotheses into a collection plan. The internal firewall logs and EDR network events answer H2, while the USB records answer H1. The proxy and email logs for both PCs are needed only for H3, so they are requested from the network team with the case reference.
6.4 Early results
The internal firewall shows no connections from WARD4-PC2 to PHARM-PC3 (weakens H2). EDR shows a USB mount on PHARM-PC3 at 11:15 (supports H1).
The PHARM-PC3 mount at 11:15 came one minute before that PC's proxy contact at 11:16, the same pattern as on Ward 4. Sana writes 'supports' and 'weakens' rather than 'proves', because a single source can still be incomplete. H3 remains untested until the proxy and email searches are finished. Those words keep the hypothesis table honest when Owen reviews it and when the board later reads the summary.
6.5 Updating
WARD2-PC1 is added to the model after USB records show the same stick connected there the previous afternoon.
WARD2-PC1 had not reported a pop-up, so without the USB records nobody would have looked at it. Adding it changed the question from how the program spread between two PCs to where the stick had been. The model is updated in the ticket with the date and the evidence that caused the change. The stick's mount on WARD2-PC1 at 15:40 on 13 September is the record that brought it into the model.
6.6 Sharing
The diagram is attached to the ticket and reviewed with Owen.
Reviewing the diagram together lets Owen spot missing systems or doubtful edges before collection goes further. It was during this review that he asked where the stick had been before Ward 2, a question written into the diagram's notes as an open item for the next review, since the mount on WARD2-PC1 at 15:40 on 13 September was still the earliest record of the stick. The reviewed version is the one attached to the ticket, with earlier versions kept so the reasoning can be followed later.
6.7 Limits
The model shows known systems; personal devices or home PCs where the rota was edited are not yet included.
The home PC where the rota was edited lies outside the hospital's authority, so it stays outside the model until the staff member agrees to have it checked. Sana marks it on the diagram as a known gap rather than leaving it off. Any conclusion about where the program first came from is limited by that gap. Personal devices of other staff who handled the rota are also outside the model for the same reason.
Using the model for questions
The model also guides questions to people: the ward manager is asked who keeps the stick and where it travels; pharmacy staff are asked whether anyone used it there. Answers are recorded as statements, separate from digital evidence, and checked against USB records where possible.
Worked example
Sana writes the hypothesis table: H1 supported (USB mounts on PHARM-PC3 and WARD2-PC1); H2 weakened (no internal connections); H3 not yet tested (no other download records found so far). Owen adds a question: where was the stick before Ward 2?
Synthetic case. The model is invented.
Errors and limits
Absence of firewall records weakens H2 only if the firewall logs all internal traffic between those segments; Sana confirms it does.
Exercises
- EX021 — Three hypotheses. State the three spread hypotheses. Rubric: 3 = USB carried, network spread, independent internet; 2 = two; 1 = one; 0 = none.
- EX022 — H2 evidence. What evidence would support H2? Rubric: 3 = internal firewall/EDR connections WARD4→PHARM; 2 = partial; 1 = vague; 0 = none.
- EX023 — Weakening condition. When does missing firewall data weaken H2? Rubric: 3 = only if firewall logs that traffic; confirmed; 2 = partial; 1 = always; 0 = none.
- EX024 — Owen's question. What question did Owen add, and why? Rubric: 3 = stick's history before Ward 2; find origin; 2 = partial; 1 = vague; 0 = none.
Synthesis
Model the systems, state rival hypotheses, map evidence to each and update as results come in.
Continue studying — chapter 06 of 18
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →