Chapter 11 — Digital forensics and malware analysis: assets and context | Technologist Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Why assets matter"]
  N2["11.2 Sensitivity"]
  N3["11.3 Evidence value"]
  N4["11.4 Owners"]
  N5["11.5 Context"]
  N6["11.6 Gaps"]
  N7["11.7 Keeping current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Why assets matter"]
  N2["11.2 Sensitivity"]
  N3["11.3 Evidence value"]
  N4["11.4 Owners"]
  N5["11.5 Context"]
  N6["11.6 Gaps"]
  N7["11.7 Keeping current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Why assets matter]
    |
    v
[11.2 Sensitivity]
    |
    v
[11.3 Evidence value]
    |
    v
[11.4 Owners]
    |
    v
[11.5 Context]
    |
    v
[11.6 Gaps]
    |
    v
[11.7 Keeping current]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) build an asset inventory relevant to forensics; (2) rank assets by data sensitivity and evidence value; (3) identify asset owners; (4) use context to prioritise collection.

11.1 Why assets matter

You cannot preserve evidence from systems you do not know exist. Alder Falls' inventory lists desktops, servers, network devices, cloud services and their owners.

During the CLERK-03 case the inventory told Renata which office the PC belonged to, who owned the permits system it could reach and where its logs went. The forgotten planning server shows the reverse: a machine nobody listed could have been compromised without anyone thinking to check it. Inventory work looks dull until the day it decides what gets examined.

11.2 Sensitivity

The permits system holds residents' names, addresses and payment details; the GIS server holds maps. Data protection duties attach to personal data, so systems holding it rank higher.

Ranking by sensitivity also shapes collection: evidence copied from the permits system may contain residents' personal data, so it must be stored and accessed with the same care as the original. Jonah notes the sensitivity level of each asset beside its evidence value, because a system can be important for one reason and not the other, and the two rankings lead to different decisions.

11.3 Evidence value

Domain controllers, firewalls, VPN and proxy servers hold evidence about many systems at once. They rank high for collection even if they hold little personal data.

In the CLERK-03 case, the domain controller could show whether mfoster's account was used elsewhere, and the firewall showed the large transfer from mfoster's desktop. Neither holds the residents' data that makes the case serious, yet both answer questions no single desktop can. Jonah ranks them high so their logs are exported before routine rotation removes the period in question.

11.4 Owners

Each asset has a business owner and a technical owner. Collection from the permits system needs the permits manager informed.

Business owners decide whether their service can tolerate collection or isolation; technical owners know where logs are and how to export them. For the permits database, Jonah contacts the technical owner for access-log exports and Renata informs the permits manager. Recording both names in the inventory saves hours when an incident starts after working hours. Owners should also know they will be told before collection touches their system.

11.5 Context

CLERK-03 belongs to the permits office and can reach the permits database. That raises the priority of checking database access logs.

Context changes priorities quickly. Because CLERK-03 can reach the permits database, and mfoster's desktop exported a large resident report, the database's access logs move to the top of the collection list. A desktop in a department without access to personal data would still matter but would not raise the same urgency. Jonah records why each priority changed, so the order can be justified afterwards.

11.6 Gaps

Jonah finds a forgotten server under a desk in the planning department, not in the inventory and not patched since 2021. It is added and checked.

An unlisted, unpatched server is a likely foothold and a blind spot at once: nobody collected its logs, nobody watched it, and its owner was unknown. Jonah checks it for the indicators seen on CLERK-03, records the result whatever it is, and asks the planning department who set it up and why, so the inventory captures its purpose as well as its existence.

11.7 Keeping current

Inventory updates are part of change management.

At Alder Falls Jonah proposes that every change request include an inventory check: new system added, owner named, log destination recorded; decommissioned system removed, with its logs retained for the agreed period. Without that link, the inventory drifts out of date between annual reviews and the next investigation starts with wrong information. The planning server shows what happens without it: a machine running for years, patched by nobody, invisible to every responder. A quarterly comparison of the inventory with DHCP leases and network scans catches devices that slipped through change control.

Cloud assets

The city also uses cloud email and a hosted payments portal. Their logs live with providers, under contract terms that set retention and access. Jonah records each cloud service in the inventory with the log types available, how to request them, and how long they are kept, so investigators know quickly what can be obtained.

Worked example

Jonah ranks collection targets: CLERK-03 (affected), 10.20.4.12 (source of logon), permits database server (data at risk), domain controller (account evidence), firewall (traffic evidence). Renata approves the order, adding the forgotten planning server as a check.

Synthetic case. The inventory is invented.

Errors and limits

Inventories are always incomplete; network scans and log reviews help find what is missing.

Exercises

EX031 — Evidence-rich assets. Why rank the domain controller high despite little personal data?
Show marking criteria
Rubric: 3 = holds evidence about many systems; 2 = partial; 1 = no reason; 0 = none.
EX032 — Context effect. Why check permits database logs?
Show marking criteria
Rubric: 3 = CLERK-03 can reach it; personal data at risk; 2 = partial; 1 = random; 0 = none.
EX033 — Forgotten server. What did Jonah find and do?
Show marking criteria
Rubric: 3 = unlisted unpatched planning server; added and checked; 2 = partial; 1 = ignored; 0 = none.

Synthesis

An inventory with owners, sensitivity and evidence value tells responders what to preserve first.

Continue studying — chapter 11 of 30

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →