Chapter 15 — Digital forensics and malware analysis: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Manifests"]
N2["15.2 Hashing the manifest"]
N3["Lab — collection manifest"]
N4["15.3 Reading the result"]
N5["15.4 Handover"]
N6["15.5 Detecting changes"]
N7["15.6 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Manifests"]
N2["15.2 Hashing the manifest"]
N3["Lab — collection manifest"]
N4["15.3 Reading the result"]
N5["15.4 Handover"]
N6["15.5 Detecting changes"]
N7["15.6 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Manifests]
|
v
[15.2 Hashing the manifest]
|
v
[Lab — collection manifest]
|
v
[15.3 Reading the result]
|
v
[15.4 Handover]
|
v
[15.5 Detecting changes]
|
v
[15.6 Lessons]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) build a manifest of collected files with sizes and hashes; (2) make the manifest itself verifiable; (3) use the manifest in handover; (4) detect changes after handover.
15.1 Manifests
A manifest lists every collected file with name, size and hash. It lets the receiver confirm nothing was lost or altered, and it supports the auditability principle of ISO/IEC 27037.
In this case the manifest for mfoster's desktop lists 47 files, and Renata verifies each one on receipt. Without a manifest, a missing file or a silently altered one could go unnoticed until an analyst found a gap. The manifest also states what the collection contains, which helps later readers understand what was and was not gathered.
15.2 Hashing the manifest
Hashing the manifest itself, with sorted keys, gives one value that summarises the whole collection. Recording that value in the custody log ties the collection together.
Sorting keys before hashing matters because the same data in a different order would give a different hash. Jonah records the manifest hash in the custody log and sends it to Renata separately from the drive, so the value cannot be altered along with the files. Anyone receiving the collection can recompute it and compare.
Lab — collection manifest
"""Collect metadata and SHA-256 for a synthetic folder into a manifest."""
import hashlib, os, tempfile, json
with tempfile.TemporaryDirectory() as d:
for name, body in {"permits.xlsx": b"synthetic-permit-data", "helper.exe": b"MZsynthetic", "readme.txt": b"hello"}.items():
with open(os.path.join(d, name), "wb") as f: f.write(body)
manifest = []
for name in sorted(os.listdir(d)):
p = os.path.join(d, name)
with open(p, "rb") as f: digest = hashlib.sha256(f.read()).hexdigest()
manifest.append({"name": name, "size": os.path.getsize(p), "sha256": digest[:12]})
for m in manifest: print(m["name"], m["size"], m["sha256"])
print("manifest sha256:", hashlib.sha256(json.dumps(manifest, sort_keys=True).encode()).hexdigest()[:12])
Run with python3 lab_triage.py. Verified output:
helper.exe 11 3a3bb2549b8e
permits.xlsx 21 80d4c531e684
readme.txt 5 2cf24dba5fb0
manifest sha256: a23393100c9c
15.3 Reading the result
Three synthetic files are listed with sizes (11, 21 and 5 bytes) and truncated SHA-256 values; the manifest's own hash is a23393100c9c (truncated for display). If any file changes, its hash changes, and so does the manifest hash.
The lab uses short invented file contents so the output is easy to check by hand, and it reads small files whole; a real collector would read large files in chunks. The point to take away is the chain from file to file hash to manifest hash.
15.4 Handover
Jonah gives Renata the collection drive, the manifest and the manifest hash, recorded in the custody log. She recomputes and confirms.
Renata's confirmation is recorded with the time and her name next to Jonah's handover entry. If her recomputed value had differed, she would refuse the handover until the cause was found. For the 47 files from mfoster's desktop, every hash and the manifest hash matched, and the custody log shows the moment the collection passed from Jonah to her. The drive itself is then sealed and stored.
15.5 Detecting changes
Later, an analyst reports a different hash for helper.exe. Comparing with the manifest shows the analyst's copy was modified — antivirus on their workstation had quarantined and altered it. The original on the evidence store still matches.
Without the manifest, the analyst might have concluded that helper.exe had changed on the evidence store, casting doubt on the whole collection. With it, the change is located precisely: the analyst's copy, not the original. Jonah notes the incident in the case file, because a reviewer will want to know why two hashes for one file appear in the records.
15.6 Lessons
Analysis copies should be made from the evidence store each time, on machines with antivirus exclusions for evidence folders.
Jonah adds a line to the handover note sent with every archive: open only on an analysis machine with antivirus exclusions for the evidence folder, and verify each hash before starting. The external analyst agrees to report any mismatch at once. The lesson is cheap to apply and prevents a misleading result from appearing in a report. It also protects the analyst's own machine from accidental execution.
15.7 Truncated display
Full hashes are stored; truncation is only for display.
The lab itself stores the shortened digests in its manifest to keep the printed output short, so its manifest hash is computed over twelve-character values. A real manifest stores the full digest for each file, which gives a different manifest hash. Jonah's production script stores full digests and prints shortened ones only on screen, and the case notes say which form a quoted value is. Twelve characters are enough to tell files apart on screen but too few to prove integrity in a dispute. A shortened value in a report should always be traceable to the full value stored in the manifest.
Manifest format
Jonah stores manifests as JSON with a fixed field order and UTF-8 encoding, plus a plain-text copy for printing. Both carry the same hash list, so either can be checked.
Worked example
The manifest for 10.20.4.12's collection lists 47 files. Renata verifies all 47 on receipt and signs the custody log with the manifest hash and time.
Synthetic case. Files are created by the lab script in a temporary folder.
Errors and limits
A manifest confirms what was collected, not that everything relevant was collected.
Exercises
- EX043 — Manifest hash. Why hash the manifest itself? Rubric: 3 = one value summarises whole collection; any change detected; 2 = partial; 1 = smaller; 0 = none.
- EX044 — Altered copy. What caused the analyst's different hash? Rubric: 3 = antivirus quarantined/altered copy; original still matches; 2 = partial; 1 = evidence changed; 0 = none.
- EX045 — Copy practice. What practice prevents that problem? Rubric: 3 = fresh copies from store; AV exclusions for evidence folders; 2 = one; 1 = vague; 0 = none.
Synthesis
Manifests and their hashes make collections verifiable end to end and expose later alterations.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →