Chapter 7 — Digital forensics and malware analysis: data and telemetry
Lesson map
Lesson 07 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Telemetry sources"]
N2["Lab — tracking a USB serial"]
N3["7.2 Reading the result"]
N4["7.3 Was WARD2-PC1 infected?"]
N5["7.5 Earlier history"]
N6["7.6 Telemetry retention"]
N7["7.7 Recording"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Telemetry sources"]
N2["Lab — tracking a USB serial"]
N3["7.2 Reading the result"]
N4["7.3 Was WARD2-PC1 infected?"]
N5["7.5 Earlier history"]
N6["7.6 Telemetry retention"]
N7["7.7 Recording"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX025"]
[Learning outcomes]
|
v
[7.1 Telemetry sources]
|
v
[Lab — tracking a USB serial]
|
v
[7.2 Reading the result]
|
v
[7.3 Was WARD2-PC1 infected?]
|
v
[7.5 Earlier history]
|
v
[7.6 Telemetry retention]
|
v
[7.7 Recording]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) use device telemetry to trace removable media across hosts; (2) group records by device serial; (3) build a movement history; (4) recognise limits of serial-based tracking.
7.1 Telemetry sources
EDR and Windows logs record USB connections with device serial numbers. Collected centrally, they let operators trace one stick across many PCs.
Central collection matters because the stick moved between PCs on two different days, and no single PC's records would show the whole path. The EDR console and the Windows logs gathered by the triage tool both carry the serial. Sana searches them for SN-7731 by serial rather than by host. A search by host would have found each sighting separately, while a search by serial shows the whole path at once.
Lab — tracking a USB serial
"""Summarise synthetic USB connection records by device serial."""
from collections import defaultdict
rec = [("WARD4-PC2", "SN-7731", "2026-09-14T10:02:09Z"), ("WARD2-PC1", "SN-7731", "2026-09-13T15:40:00Z"),
("WARD4-PC2", "SN-1002", "2026-09-10T08:00:00Z"), ("PHARM-PC3", "SN-7731", "2026-09-14T11:15:30Z")]
by = defaultdict(list)
for host, sn, t in rec: by[sn].append((t, host))
for sn, items in by.items():
print(sn, "seen on", len(items), "hosts:", [h for _, h in sorted(items)])
Run with python3 lab_usb.py. Verified output:
SN-7731 seen on 3 hosts: ['WARD2-PC1', 'WARD4-PC2', 'PHARM-PC3']
SN-1002 seen on 1 hosts: ['WARD4-PC2']
7.2 Reading the result
Serial SN-7731 (the ward stick, WB-USB-01) appears on three hosts in time order: WARD2-PC1 on 13 September at 15:40, WARD4-PC2 on 14 September at 10:02, and PHARM-PC3 at 11:15. Serial SN-1002 appears only on WARD4-PC2, days earlier. The stick's path matches the spread: Ward 2, then Ward 4, then pharmacy.
The order also gives the time between connections: about eighteen hours and twenty minutes between Ward 2 and Ward 4, and seventy-three minutes between Ward 4 and pharmacy. Those gaps fit a stick carried by people between shifts rather than a program spreading over the network.
7.3 Was WARD2-PC1 infected?
EDR on WARD2-PC1 shows the shortcut opened but the script blocked by an application control rule applied to Ward 2 in a pilot. Ward 4 and pharmacy were not yet in the pilot.
The outcome on WARD2-PC1 rests on a logged block event, not on the absence of symptoms, so it can be shown to the IT board. This makes the pilot's result direct evidence for extending it. Sana records the block event's time and the rule name from the EDR console.
7.4 Limits
Serial numbers can be missing, duplicated across cheap devices, or spoofed. Corroborate with physical custody and statements.
For the ward stick, the serial is corroborated by the custody record for WB-USB-01 and by the ward manager's statement that one stick was used for rotas. A cheap stick sharing its serial with another device could make two sticks look like one. That is why the table is never treated as proof on its own. The SN-1002 device seen only on WARD4-PC2 days earlier is recorded but not linked to the incident.
7.5 Earlier history
Before 13 September, SN-7731 appears on no hospital PC. The ward manager says a staff member edited the rota at home. A personal device is outside the hospital's authority; Owen asks the staff member, who agrees to have their home PC checked by their own provider and shares the result.
The staff member's own provider reported the result, and Sana records it as a statement from a third party rather than as hospital evidence. Without access to the home PC, the case cannot show exactly how the shortcut and hidden script reached the stick. The case file states this limit plainly in its findings summary.
7.6 Telemetry retention
USB records are kept 90 days centrally, enough here.
The 90-day EDR retention matched policy, so the USB records for 13 and 14 September were still available when Sana searched. Had the stick first been used months earlier, those records could already have been deleted. Retention for each source is therefore checked against policy in the control-configuration work later in the course. Proxy and DHCP retention were shorter than policy, which the retention lab later confirms with the actual values. The 90 days were confirmed in the EDR console's settings before Sana relied on them.
7.7 Recording
The movement history table goes into the ticket with sources.
The table lists each sighting with host, date, time, source and outcome, and the ticket names the export each row came from. A reader can trace every row back to a hashed export. Sana adds the outcome column, such as 'script blocked' for Ward 2, so the table also shows which defence worked. The ward manager's signed statement about the stick's use is kept with the table and cited beside the rows it supports.
Statements
The ward manager's account of the stick's use is written down, dated and signed, and kept with the telemetry table.
Worked example
Sana's table: "SN-7731: WARD2-PC1 13/09 15:40 (script blocked by pilot control); WARD4-PC2 14/09 10:02 (script ran, svch.exe dropped); PHARM-PC3 14/09 11:15 (script ran)." She marks the blocking control as a finding for rollout.
Synthetic case. Records come from the lab script.
Errors and limits
Telemetry covers managed PCs only; the stick's journey through unmanaged devices is unknown.
Exercises
- EX025 — Stick path. Give SN-7731's path in time order. Rubric: 3 = WARD2-PC1, WARD4-PC2, PHARM-PC3 with times; 2 = order only; 1 = wrong; 0 = none.
- EX026 — Ward 2 outcome. Why was WARD2-PC1 not infected? Rubric: 3 = application control pilot blocked script; 2 = partial; 1 = luck; 0 = none.
- EX027 — Serial limits. Name two limits of serial-based tracking. Rubric: 3 = missing, duplicated, spoofed serials; 2 = one; 1 = vague; 0 = none.
- EX028 — Home PC. How was the home PC question handled? Rubric: 3 = outside authority; staff consent, own provider checked; 2 = partial; 1 = examined it; 0 = none.
Synthesis
Central telemetry traces removable media across hosts; corroborate serials and respect authority boundaries.
Continue studying — chapter 07 of 18
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →