Chapter 29 — Capstone build | Technologist Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 29 — Capstone build

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Capstone"]
  N2["29.2 Build"]
  N3["29.3 End-to-end test"]
  N4["29.4 Results"]
  N5["29.5 Problems"]
  N6["29.6 Documentation"]
  N7["29.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Capstone"]
  N2["29.2 Build"]
  N3["29.3 End-to-end test"]
  N4["29.4 Results"]
  N5["29.5 Problems"]
  N6["29.6 Documentation"]
  N7["29.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Capstone]
    |
    v
[29.2 Build]
    |
    v
[29.3 End-to-end test]
    |
    v
[29.4 Results]
    |
    v
[29.5 Problems]
    |
    v
[29.6 Documentation]
    |
    v
[29.7 Review]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) build the capstone deliverable; (2) integrate tools, procedures and records; (3) test end to end; (4) document for handover.

29.1 Capstone

Jonah's individual capstone: "Alder Falls Readiness Pack" — Triage Kit 2 refinements, a log-source register, the nightly integrity job, an incident collection runbook set, and an exercise scenario library.

Each component answers a lesson from the incident: the kit refinements make collection reliable, the log-source register shows what evidence exists and for how long, the integrity job protects stored evidence, the runbooks let non-specialists act correctly and the scenario library keeps practice going. Together they form a pack the city can maintain without the student team.

29.2 Build

Scripts (manifest, verification, log parsing with unmatched-line counts) use only the standard library. The log-source register lists each source, what it records, retention, forwarding status and owner.

Using only the standard library keeps the scripts easy to validate and install on sensitive machines, as the team decided in the studio project. The unmatched-line counts come from the troubleshooting lesson with millisecond timestamps. Each script has tests on synthetic data and a version recorded in the repository, and the register is reviewed with each source's owner.

29.3 End-to-end test

A synthetic incident is planted on test machines: brute-force from one desktop, service installation on another, data upload. Operators run the full process from alert to handover; Jonah measures times and checks every record.

The synthetic incident echoes the May case: guessing from one desktop, a service installed on another and an upload, so the test exercises the same steps the real incident needed. Operators, not Jonah, run the process, which tests whether the runbooks work for their intended users. Jonah measures each step and checks every record against the runbooks' expected outputs.

29.4 Results

Alert to analyst call: 6 minutes. Memory captured from both test desktops: 31 minutes. All manifests verified; custody records complete; timeline built from forwarded logs in 20 minutes.

Compared with the incident, where memory capture took about two hours and the timeline was built by hand from local logs, these figures show a large improvement. They come from a planned test on prepared machines, though, so they are a best case. Jonah reports them with that caveat and with the date and machines used.

29.5 Problems

The exercise scenario's synthetic upload was blocked by the new proxy rule, so the upload evidence was a blocked-connection log — useful in itself. The scenario is updated to note both outcomes.

An unexpected result in a test is information, not a failure. The blocked upload shows the new proxy rule works and that its log provides evidence of an attempt. The scenario now describes both outcomes, a successful upload where the rule is absent and a blocked attempt where it is present, so future exercises use the right expectations.

29.6 Documentation

Every component has a README, version and owner.

A README explains what a component does, how to run it, what it needs and how to test it; the version and owner tell a reader whether they have the current copy and whom to ask. Jonah checks that someone outside the team can follow each README on a clean machine before the pack is released. The pack's top-level README lists every component, its owner and where its runbook lives, so a new operator can find everything from one page.

29.7 Review

Renata reviews the pack against the city's needs; the IT manager reviews costs.

Renata checks whether the pack would have shortened the May investigation and whether its records would satisfy a reviewer; the IT manager checks that ongoing costs, such as storage and staff time, fit the budget. Their comments are recorded with Jonah's responses and any changes made before release. Both reviews are completed before version 1.0 is tagged, and any unresolved comment is listed as a known issue with an owner.

Version and release

The pack is released as version 1.0 with a change log and a manifest of all files and their hashes. Future updates follow the same process, so the city always knows which version is deployed and can reproduce past responses. Jonah tags the repository and stores the release archive in the evidence store's tool area, so investigators can retrieve the exact scripts used in any later case.

Worked example

Jonah's test report row: "Step: manifest verification on receipt. Expected: all hashes match. Result: 47/47 match. Evidence: custody log entry 2026-11-03 14:22." Each step has a matching row.

Synthetic case. The capstone is invented.

Errors and limits

End-to-end tests on test machines miss some production complexity; real incidents will reveal more.

Exercises

EX085 — Pack contents. List four components of the Readiness Pack. Rubric: 3 = kit, log register, integrity job, runbooks, scenarios (any four); 2 = three; 1 = one; 0 = none.
EX086 — Test results. Report two end-to-end timings. Rubric: 3 = 6 min alert-to-call; 31 min memory (or 20 min timeline); 2 = one; 1 = wrong; 0 = none.
EX087 — Blocked upload. What happened to the synthetic upload, and why is it useful? Rubric: 3 = blocked by proxy; blocked-log evidence shows control works; 2 = partial; 1 = failure; 0 = none.

Synthesis

The capstone integrates tools, procedures and records and proves them end to end.

Continue studying — chapter 29 of 30

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →