Chapter 16 — Digital forensics and malware analysis: methods II
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Combining hosts"]
N2["16.2 The reconstruction"]
N3["16.3 Hypotheses"]
N4["16.4 Results"]
N5["16.5 Presenting"]
N6["16.6 Cautions"]
N7["16.7 Peer review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Combining hosts"]
N2["16.2 The reconstruction"]
N3["16.3 Hypotheses"]
N4["16.4 Results"]
N5["16.5 Presenting"]
N6["16.6 Cautions"]
N7["16.7 Peer review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Combining hosts]
|
v
[16.2 The reconstruction]
|
v
[16.3 Hypotheses]
|
v
[16.4 Results]
|
v
[16.5 Presenting]
|
v
[16.6 Cautions]
|
v
[16.7 Peer review]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) build a combined timeline across hosts; (2) link events by account and address; (3) form and test hypotheses about access; (4) present the reconstruction clearly.
16.1 Combining hosts
Events from CLERK-03, 10.20.4.12 (desktop PLAN-07), the domain controller, the permits application and the firewall are merged in UTC.
Merging works only if every source is in the same time base and each event keeps a pointer to its origin. Jonah converts all times to UTC, records the original value and zone, and adds a column naming the source log and line. When two sources disagree by a few seconds, he keeps both entries rather than choosing one, so the merged view never hides a discrepancy that a reviewer might need to see.
16.2 The reconstruction
07:40 mfoster account signs in to PLAN-07. Jonah first assumes a VPN sign-in, then checks the logon type: it was interactive at the console. 07:58 failed logons from PLAN-07 to FILESRV-02 begin. 08:01–08:02 guessing then success on CLERK-03 local admin from PLAN-07. 08:05 service installed on CLERK-03. 08:31 resident report exported via permits app under mfoster on PLAN-07. 08:40 600 MB to file-sharing service from PLAN-07.
Jonah's correction about the 07:40 sign-in is worth noticing: his first assumption, a VPN connection, would have pointed the investigation outside the building, while the logon type showed a console session. Checking a field before building a story on it is the habit the chapter teaches. The sequence also shows the order of attack: the file server attempts begin before the successful logon on CLERK-03, and the data export follows almost half an hour after the service was installed.
16.3 Hypotheses
H1: someone used mfoster's account at PLAN-07 physically. H2: remote control of PLAN-07 by malware. H3: mfoster themselves, despite leave records. Tests: building access logs for the planning office; memory on PLAN-07 for remote-access tools; HR confirmation of leave.
Each hypothesis is paired with a test that would come out differently if it were false. Building access logs separate physical presence from remote use; memory on PLAN-07 can show a remote-access tool or its absence; HR can confirm or contradict the leave record. Writing the tests before collecting the results keeps Jonah from reading whatever he finds as support for the hypothesis he already prefers.
16.4 Results
Memory on PLAN-07 shows helper.exe running with an outbound connection to an external address, consistent with remote control (H2). Building access shows no entry to the planning office that morning, weakening H1. HR confirms mfoster was abroad.
The three results point the same way, but they are not equally strong. The running helper.exe with an outbound connection is direct evidence from the machine; the absence of a building entry depends on the access system recording every entry; HR's confirmation is a statement about mfoster's travel. Jonah reports each with its source, so the conclusion's weight is visible rather than implied.
16.5 Presenting
A table: time, host, source, event, artefact. A short narrative follows, marked as interpretation.
The table lets a reader check each event against its artefact, such as the logon record or the firewall line, without reading the narrative first. The narrative then explains how the events connect, and its marking as interpretation tells managers which sentences are observations and which are the team's reasoning. Keeping the two apart makes it easy to revise the story if new evidence appears. The swim-lane chart summarises both for managers.
16.6 Cautions
Console sign-in at 07:40 with no building entry suggests the "console" session may have been an existing session resumed remotely; this needs examination.
The console sign-in at 07:40 is the weakest link in the reconstruction. If the session was resumed remotely, the record should show a reconnection rather than a fresh logon, and the memory capture may hold the remote tool's connection history. Until that is examined, Jonah writes that the 07:40 event is unexplained rather than forcing it to fit the remote-control hypothesis.
16.7 Peer review
Renata reviews the timeline before it is shared.
Renata checks that each time is in UTC, each event cites its source, and each interpretation is labelled. She also asks what evidence would contradict the reconstruction and whether anyone looked for it. Her review of the 07:40 sign-in led to the caution about a resumed session; without review, the console logon might have been reported as physical presence. Review also catches simple errors, such as a time left in local time or a source column copied from the wrong row. Renata signs and dates the reviewed version, and only that version is shared.
Visualising
A swim-lane chart with one lane per host makes the movement from PLAN-07 to CLERK-03 and FILESRV-02 easy to follow for managers.
Worked example
Jonah's narrative: "Evidence is consistent with PLAN-07 being remotely controlled through helper.exe, using mfoster's existing session, to attack CLERK-03 and FILESRV-02 and to export and upload resident data. It does not support mfoster's physical presence."
Synthetic case. The events are invented.
Errors and limits
Reconstructions depend on logged events; unlogged actions (USB, screen viewing) remain unknown.
Exercises
- EX046 — Three hypotheses. List the three access hypotheses. Rubric: 3 = physical use of account, remote control by malware, mfoster themselves; 2 = two; 1 = one; 0 = none.
- EX047 — H2 support. What evidence supports H2? Rubric: 3 = helper.exe running with outbound connection in memory; no building entry; HR abroad; 2 = partial; 1 = vague; 0 = none.
- EX048 — Self-correction. What did Jonah correct in his reconstruction? Rubric: 3 = checked sign-in type: console not VPN; then questioned resumed session; 2 = partial; 1 = vague; 0 = none.
Synthesis
Multi-host timelines with explicit hypotheses and tests turn scattered events into a defensible reconstruction.
Continue studying — chapter 16 of 30
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →