Chapter 12 — Digital forensics and malware analysis: data flows
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Mapping flows"]
N2["12.2 Logging points"]
N3["12.3 Scoping data theft"]
N4["12.4 Findings"]
N5["12.5 Unlogged paths"]
N6["12.6 Reporting"]
N7["12.7 Privacy"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Mapping flows"]
N2["12.2 Logging points"]
N3["12.3 Scoping data theft"]
N4["12.4 Findings"]
N5["12.5 Unlogged paths"]
N6["12.6 Reporting"]
N7["12.7 Privacy"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Mapping flows]
|
v
[12.2 Logging points]
|
v
[12.3 Scoping data theft]
|
v
[12.4 Findings]
|
v
[12.5 Unlogged paths]
|
v
[12.6 Reporting]
|
v
[12.7 Privacy]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) map data flows between city systems; (2) identify where flows are logged; (3) use flows to scope possible data theft; (4) spot unlogged paths.
12.1 Mapping flows
Jonah draws flows: clerks' desktops → permits application server → permits database; database → nightly backup → offsite storage; desktops → proxy → internet; staff → VPN → internal systems.
Drawing the map forced questions nobody had asked: could a clerk's desktop reach the database directly, or only through the application? Does the backup copy go anywhere except offsite storage? Jonah marks each arrow with the protocol and whether it is logged, and has the system owners confirm the map, because flows assumed from documentation are often incomplete.
12.2 Logging points
The permits application logs queries by user; the database logs connections; the proxy logs web traffic; the firewall logs all internet connections; backups are logged by the backup system.
Each logging point records different things and keeps them for different periods. The application records which user ran which export; the database records connections but not which report; the firewall records volume and destination but not content. Jonah lists the retention for each beside the flow, because a logging point that keeps data for a week is useless for an incident found a month later.
12.3 Scoping data theft
If residents' data left, it would travel along a flow to the internet. Firewall and proxy logs at the edge would show volume and destination.
For Alder Falls the internet edge is the narrow point every outbound flow must pass, except paths that avoid the network entirely. That is why the firewall and proxy logs were requested early. A transfer that does not appear there either did not happen over the network or used a path the map has not yet captured.
12.4 Findings
From 10.20.4.12, the firewall shows a 600 MB transfer to an external file-sharing service at 08:40. The permits application shows that the same desktop's logged-on user exported a large resident report at 08:31 — but that user was on leave that day according to HR.
Together these records make a sequence worth investigating: an export at 08:31 by an account whose owner was on leave, then a transfer of similar size from the same desktop nine minutes later. Jonah reports the times and sources and leaves the interpretation to Renata, noting that HR's leave record is itself a source that should be confirmed.
12.5 Unlogged paths
USB copying from desktops is not logged centrally. Jonah lists it as a path that cannot be ruled out.
Listing the path matters because the absence of a firewall record could otherwise be read as proof that data did not leave. Jonah writes that USB copying from the source desktop is possible and unlogged, so it can be neither confirmed nor excluded from central records. Examining the desktop itself may later show device connection records. Jonah adds USB logging to the readiness list.
12.6 Reporting
Flow maps with logging points go into the case file.
The map for this case shows each flow, its logging points, retention and what was found at each point. A reviewer can see at once that edge logs support the transfer, application logs support the export, and the USB path has no central evidence. The map makes the gaps as visible as the findings. Jonah dates the map and lists who confirmed each flow, so later readers know how far to trust it. Maps from earlier cases are kept too; comparing them shows how the city's flows have changed.
12.7 Privacy
Exported report contents are reviewed only as needed to determine what personal data were involved.
For the mfoster export, that means confirming which fields the report contained, such as names, addresses and payment details, and how many residents were included, without reading individual records more than needed. The data protection officer needs those facts to decide on notification; the investigators do not need to browse residents' details to supply them. Access to the exported report copy is limited to the people who need it, and each access is recorded.
Backup flows
Backups copy the permits database nightly to offsite storage. Jonah checks the backup logs for unusual restores or exports, since attackers sometimes take data from backups rather than live systems. None appear, and he records that the check was done and how.
Worked example
Jonah's flow table row: "Desktop 10.20.4.12 → permits app (export 08:31, account mfoster) → local disk → firewall → file-sharing service (600 MB, 08:40)." Renata notes that mfoster was on leave and that the account may have been used by someone else, a question for the domain controller logs.
Synthetic case. The flows are invented.
Errors and limits
Volume matches suggest but do not prove that the exported report is what left; content may differ.
Exercises
- EX034 — Edge evidence. Which logs show data leaving to the internet? Rubric: 3 = firewall and proxy at edge; 2 = one; 1 = vague; 0 = none.
- EX035 — mfoster issue. Why is the mfoster export suspicious? Rubric: 3 = account used while owner on leave; possible misuse; 2 = partial; 1 = big file; 0 = none.
- EX036 — Unlogged path. Which path cannot be ruled out, and why? Rubric: 3 = USB copying, not centrally logged; 2 = partial; 1 = vague; 0 = none.
Synthesis
Flow maps show where data can go and where evidence of that movement exists — or does not.
Continue studying — chapter 12 of 30
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →