Chapter 1 — Computing systems
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The technologist's place"]
N2["1.2 Layers"]
N3["1.3 Volatile and persistent"]
N4["1.4 Routine actions with forensic effects"]
N5["1.5 The pause habit"]
N6["1.6 Servers and virtual machines"]
N7["1.7 Inventory"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The technologist's place"]
N2["1.2 Layers"]
N3["1.3 Volatile and persistent"]
N4["1.4 Routine actions with forensic effects"]
N5["1.5 The pause habit"]
N6["1.6 Servers and virtual machines"]
N7["1.7 Inventory"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The technologist's place]
|
v
[1.2 Layers]
|
v
[1.3 Volatile and persistent]
|
v
[1.4 Routine actions with forensic effects]
|
v
[1.5 The pause habit]
|
v
[1.6 Servers and virtual machines]
|
v
[1.7 Inventory]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the hardware and software layers of the systems a technologist supports; (2) locate where evidence lives in each layer; (3) explain why administrators' routine actions can destroy evidence; (4) start a working evidence-aware habit.
1.1 The technologist's place
Jonah Pereira is in the first year of a three-year technologist programme at the fictional Brookline Polytechnic. His placement will be with the IT department of the fictional City of Alder Falls, where security analyst Renata Silva handles incidents for 600 staff. Renata's first lesson: administrators are usually first on the scene, so their habits decide whether evidence survives.
For Jonah this changes how he thinks about ordinary tickets. A slow PC, a locked account or a strange pop-up is usually routine, but occasionally it is the first sign of an incident, and the technologist who takes the call decides what happens to the evidence in the next ten minutes. The course follows his placement so that each skill is tied to a concrete decision at the city.
1.2 Layers
Hardware (CPU, memory, disks, network cards), firmware, operating system, applications and data. Each layer keeps records: firmware holds boot settings and a clock; the OS keeps logs and file metadata; applications keep histories and caches.
For a responder the useful question is which layer holds the record that answers the case question. On CLERK-03, the operating system's logs would show logons and installed services, the application layer might hold browser history, and the firmware clock would tell Jonah whether the PC's times can be trusted. Writing the layer next to each record keeps that context attached when the evidence is later combined.
1.3 Volatile and persistent
RAM, running processes and open connections disappear at shutdown; disks and logs persist until overwritten. RFC 3227 recommends collecting the most volatile evidence first.
In practice this means a decision at the keyboard: memory and network connections on CLERK-03 are lost the moment it is switched off, while its disk will still be there tomorrow. That is why Renata arranged memory capture before anything else. Persistent evidence is not permanent either; logs rotate and deleted space is reused, so it also needs prompt preservation.
1.4 Routine actions with forensic effects
Rebooting, running antivirus scans, reimaging, installing updates and "cleaning up" temp files all change or destroy evidence. None is wrong in normal operations; all need a pause when an incident is suspected.
The helpdesk colleague's antivirus scan on CLERK-03 is the typical case: a well-meant action that would have quarantined files, changed access times and possibly removed the very program Renata needed to examine. Jonah learns to ask one question first: could this be an incident? If the answer is yes or maybe, the routine fix waits for the analyst's decision.
1.5 The pause habit
Renata teaches: if something looks like an incident, stop, write down what you see with the time, isolate from the network if instructed, and call the security analyst before changing anything.
The habit is deliberately simple so it works under pressure. Jonah writes his notes on paper or in the ticket with the time from a trusted clock, not from memory afterwards. Isolation happens only when instructed, because unplugging the cable also changes state, and Renata may prefer to collect network connections first. The call to the analyst is the step that must never be skipped.
1.6 Servers and virtual machines
Virtual machines can be snapshotted, preserving disk and sometimes memory without touching the guest — a powerful option administrators control.
Snapshots must be taken with care: some platforms pause the guest briefly, and a snapshot that includes memory may hold passwords and personal data, so it needs the same protection as any evidence. At Alder Falls, Renata asks administrators to record who took a snapshot, when, of which machine and where it is stored, and to keep it until she releases it.
1.7 Inventory
Knowing what systems exist, who owns them and where logs go is the first readiness step.
At Alder Falls the inventory lists each system's name, owner, location, purpose and where its logs are sent. When CLERK-03 was reported, Jonah could look up that it belonged to the permits office and that its security log was forwarded centrally, which told Renata where to look first. An out-of-date inventory sends responders to the wrong owner or the wrong log. Jonah's placement task is to check twenty entries against what is actually on the network and report the differences.
Worked example
A clerk reports that the permits office PC, CLERK-03, is "slow and popping up windows". A helpdesk colleague starts an antivirus scan. Jonah, shadowing, asks him to pause and calls Renata. She photographs the screen, notes the time, and asks for the network cable to be unplugged while she arranges memory capture.
Synthetic case. Jonah, Alder Falls and CLERK-03 are invented.
Errors and limits
Isolating a machine changes its state too; record when and how it was done.
Exercises
- EX001 — Routine actions. Name three routine admin actions that can destroy evidence. Rubric: 3 = reboot, AV scan, reimage/updates/cleanup (any three); 2 = two; 1 = one; 0 = none.
- EX002 — Pause habit. Describe Renata's pause habit. Rubric: 3 = stop, note what and when, isolate if told, call analyst; 2 = partial; 1 = fix it; 0 = none.
- EX003 — CLERK-03 response. What did Renata do first at CLERK-03? Rubric: 3 = photographed screen, noted time, isolated network, arranged memory capture; 2 = partial; 1 = scan; 0 = none.
Synthesis
Technologists are first responders; knowing where evidence lives and pausing before routine fixes preserves it.