◇ OpenCyber Academy
Technologist · Chapter 14 · English

Chapter 14 — Digital forensics and malware analysis: methods I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 14 — Digital forensics and malware analysis: methods I

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Collection order"]
  N2["14.2 Tool footprint"]
  N3["14.3 Verification"]
  N4["14.4 Custody"]
  N5["14.5 Network isolation"]
  N6["14.6 Communication"]
  N7["14.7 After collection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Collection order"]
  N2["14.2 Tool footprint"]
  N3["14.3 Verification"]
  N4["14.4 Custody"]
  N5["14.5 Network isolation"]
  N6["14.6 Communication"]
  N7["14.7 After collection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Collection order]
    |
    v
[14.2 Tool footprint]
    |
    v
[14.3 Verification]
    |
    v
[14.4 Custody]
    |
    v
[14.5 Network isolation]
    |
    v
[14.6 Communication]
    |
    v
[14.7 After collection]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) collect volatile data under instruction; (2) follow a documented collection order; (3) record tool footprint; (4) verify and hand over collected data.

14.1 Collection order

RFC 3227 guides order by volatility. For CLERK-03 and 10.20.4.12, Renata's procedure: memory capture; running processes and network connections (from the capture); key logs and registry hives; then a full disk image if authorised.

The order reflects what disappears first. Memory holds running programs and network connections that vanish at shutdown; logs and registry hives persist but may rotate or be altered; a disk image is the most complete record and the slowest to take. For mfoster's desktop, the memory capture later showed helper.exe running with an outbound connection, evidence that a disk image alone would not have provided.

14.2 Tool footprint

Running any tool on a live system changes it: the tool loads into memory, may write files and creates log entries. NIST SP 800-86 advises understanding and documenting these effects. Jonah runs collection tools from a prepared USB drive and records exact commands, start and end times.

Running from a prepared USB drive keeps tools from being installed on the suspect machine and lets the drive be verified before and after. Jonah's note lists the time he connected the drive, each command, its output file and the time it finished. A reviewer can then separate changes made by collection from changes made by the intruder.

14.3 Verification

Each output file is hashed immediately on the collection drive and again when copied to the evidence store.

Hashing on the collection drive fixes the value before the file travels; hashing again in the evidence store shows the copy is identical. If the second value differs, Jonah stops and records the mismatch rather than recopying silently. For the memory capture from mfoster's desktop both values matched, and both were recorded with the times they were computed. A mismatch is reported to Renata before anything else happens.

14.4 Custody

Collected data get item IDs; custody records note who collected, when and where stored.

Jonah writes the custody line at the moment of collection, not later from memory: item identifier, description, hash, collector, time and storage place. Each later transfer adds a line. The record lets Renata show who had each item at every point, which matters if the case leads to disciplinary action or police involvement. The custody record is kept in the case folder with the hashes, and only the case team can edit it. Corrections are added as new lines rather than by changing old ones.

14.5 Network isolation

Machines remain isolated during collection, except where remote collection over a controlled channel is used.

Isolation stops an intruder from issuing new commands or deleting evidence while collection runs, but it also cuts any connection the malware was making, which is itself evidence. That is one reason memory is captured first. If remote collection is used, the channel is restricted to the collection server and the method is recorded in the notes. Jonah notes the exact time each machine was isolated, by whom and how.

14.6 Communication

Jonah calls Renata at each stage; she logs progress.

Calling at each stage lets Renata change plans quickly, for example adding a second capture if something unexpected appears, and gives her a contemporaneous log of progress. Jonah reports facts as he sees them, such as mfoster's session being logged on, and leaves interpretation to her. Both keep their notes, so the two records can be compared. For mfoster's desktop, the calls marked the start of capture, the hash on the drive and the matching hash in the store. Short, regular calls also mean that if Jonah is interrupted, Renata knows exactly where collection stopped.

14.7 After collection

Machines stay isolated until Renata releases them.

Releasing a machine is a decision with consequences: once rebuilt, nothing more can be collected from it. Renata releases a machine only after the collected data are verified, the analyst confirms nothing further is needed, and the owner knows what will happen. The release, with time and reason, is recorded in the case notes. Until then, the machines are labelled so nobody reconnects or reuses them by mistake. CLERK-03 and mfoster's desktop carried a tag with the case number and Renata's name until she signed the release.

Remote collection

For remote sites, the city's endpoint agent can collect memory and files over the network. Remote collection avoids travel delays but adds network traffic and relies on the agent being trustworthy. Jonah records which method was used for each host and why, so reviewers can weigh the trade-off.

Worked example

On 10.20.4.12, Jonah's memory capture runs from 10:14 to 10:22. He notes the USB drive serial, tool version and command. The capture's SHA-256 is recorded on the collection log and verified again at 10:40 after copying to the evidence store: match. The desktop's user, mfoster, is on leave; the machine was logged on under mfoster at the time of collection.

Synthetic case. The collection is invented.

Errors and limits

Live collection captures a moment; activity before capture may be gone, and tools may be detected by malware.

Exercises

Synthesis

Follow a volatility-based order, record your footprint, hash immediately and keep custody.

Continue studying — chapter 14 of 30

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →