◇ OpenCyber Academy
Technologist · Chapter 10 · English

Chapter 10 — Digital forensics and malware analysis: orientation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Digital forensics and malware analysis: orientation

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 The process"]
  N2["10.2 Technologist versus examiner"]
  N3["10.3 Malware analysis basics"]
  N4["10.4 The Alder Falls case"]
  N5["10.5 Chain of custody"]
  N6["10.6 Documentation"]
  N7["10.7 Escalation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 The process"]
  N2["10.2 Technologist versus examiner"]
  N3["10.3 Malware analysis basics"]
  N4["10.4 The Alder Falls case"]
  N5["10.5 Chain of custody"]
  N6["10.6 Documentation"]
  N7["10.7 Escalation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 The process]
    |
    v
[10.2 Technologist versus examiner]
    |
    v
[10.3 Malware analysis basics]
    |
    v
[10.4 The Alder Falls case]
    |
    v
[10.5 Chain of custody]
    |
    v
[10.6 Documentation]
    |
    v
[10.7 Escalation]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) explain the forensic process as applied by technologists; (2) know which standards guide it; (3) understand the technologist's role versus the examiner's; (4) frame the Alder Falls case.

10.1 The process

NIST SP 800-86 divides forensic work into four phases, from collection through examination and analysis to reporting. ISO/IEC 27037 covers identification, collection, acquisition and preservation of digital evidence. ISO/IEC 27042 covers analysis and interpretation.

For the CLERK-03 case the phases map onto real tasks. Collection is Jonah capturing memory and triage data under Renata's instruction; examination is extracting processes, logons and files from what was collected; analysis is Renata and the external analyst deciding what those records mean for the four case questions; reporting is the written account for the city's managers and, if needed, the data protection officer. Keeping the phases distinct helps each person know whether they are gathering facts or interpreting them.

10.2 Technologist versus examiner

Technologists preserve, collect under instruction, build tools and keep systems ready. Examiners interpret evidence and write findings. In small organisations one person may do both, but should know which role they are in at each moment.

At Alder Falls Jonah is a technologist: he collects, hashes, records and hands over, and when he notices something interesting, such as mfoster's account logged on during leave, he reports it to Renata rather than drawing conclusions himself. Renata takes the examiner's role and decides what the records mean. Knowing the boundary protects both of them if the case is later reviewed or challenged.

10.3 Malware analysis basics

Analysts identify what suspicious files do. Static analysis inspects without running; dynamic analysis runs samples in isolated sandboxes. Sikorski and Honig (2012) describe both. Technologists hand suspicious files to analysts in protected archives and never run them on production machines.

In the CLERK-03 case neither helper.exe nor svc.exe is opened or run on any city machine. Jonah records their paths, sizes and hashes, places copies in a password-protected archive and passes it to the external analyst with the hashes in a separate message. What the files do is the analyst's question; Jonah's job is to make sure the analyst receives exactly what was found.

10.4 The Alder Falls case

CLERK-03 showed password guessing, an admin logon from another desktop (10.20.4.12), a new service, a changed svc.exe and a new helper.exe. Questions: how did access begin; what do the files do; which other machines are affected; was data taken?

Each question points to different evidence. How access began needs logon records on CLERK-03 and the source desktop; what the files do needs the analyst's report; other affected machines need a search of logs and baselines across the city; whether data was taken needs firewall, proxy and application records. Writing the questions down at the start keeps collection focused and makes it obvious when a question has no evidence yet.

10.5 Chain of custody

Every item collected — memory capture, disk image, log export — gets an ID, hash and custody record.

In this case that includes the memory captures from CLERK-03 and the source desktop, the triage collections, the firewall and VPN exports and the archive sent to the external analyst. Each transfer adds a line: who handed it over, to whom, when and why. A gap in that record invites the question of whether the item could have been altered. Jonah uses one custody form per item and never reuses an identifier.

10.6 Documentation

Contemporaneous notes from the first minute.

Renata's notes from the first call record the clerk's description, the time Jonah paused the scan, when the cable was unplugged and when memory capture was arranged. Notes written at the time, with times from a trusted clock, are far more credible than a summary written days later. Jonah keeps his own notes in the same format, signed and dated, so the two accounts can be compared if anything is disputed. Notes also record what was not done, such as the scan that was stopped.

10.7 Escalation

The city's policy says incidents involving possible data breach go to the data protection officer and, if needed, police.

The CLERK-03 case may involve personal data from the permits system, so Renata informs the data protection officer early, before knowing whether data left. Escalation is not an admission that a breach occurred; it gives the officer time to judge legal duties while the facts are gathered. Jonah's role is to make sure Renata has the records she needs to brief the officer accurately and without speculation.

Scope of this book

The chapters ahead follow the case through modelling, collection, tooling, controls and a capstone triage kit, with labs on synthetic data at each stage.

Worked example

Renata's initial notes list the four questions and assign tasks: Jonah collects memory and triage from CLERK-03 and 10.20.4.12 under her instruction; she requests firewall and VPN logs; an external malware analyst receives helper.exe and svc.exe in a password-protected archive with hashes.

Synthetic case. The case is invented.

Errors and limits

Roles blur in small teams; documenting who did what keeps responsibility clear.

Exercises

Synthesis

Technologists support a standards-based forensic process by preserving, collecting and handing over safely.

Continue studying — chapter 10 of 30

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →