◇ OpenCyber Academy
Technologist · Chapter 6 · English

Chapter 6 — Operating systems and virtualization

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Operating systems and virtualization

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 OS records"]
  N2["6.2 Baselines"]
  N3["Lab — before/after comparison"]
  N4["6.3 Reading the result"]
  N5["6.4 Virtualization"]
  N6["6.5 Snapshot cautions"]
  N7["6.6 Containers"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 OS records"]
  N2["6.2 Baselines"]
  N3["Lab — before/after comparison"]
  N4["6.3 Reading the result"]
  N5["6.4 Virtualization"]
  N6["6.5 Snapshot cautions"]
  N7["6.6 Containers"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 OS records]
    |
    v
[6.2 Baselines]
    |
    v
[Lab — before/after comparison]
    |
    v
[6.3 Reading the result]
    |
    v
[6.4 Virtualization]
    |
    v
[6.5 Snapshot cautions]
    |
    v
[6.6 Containers]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) explain OS components relevant to evidence; (2) use snapshots and listings to detect changes; (3) compare before/after file states; (4) understand virtualization's forensic advantages.

6.1 OS records

The OS keeps file-system metadata, logs, the registry (on Windows), service lists and scheduled tasks. Carrier (2005) explains how file systems store metadata separately from content, which is why listings with hashes can reveal changes.

On a Windows desktop like CLERK-03, the service list showed the new service, the file system showed helper.exe and the changed svc.exe, and the registry would record how the service is configured to start. Each record answers a different part of the question of what changed and when.

6.2 Baselines

Alder Falls keeps a weekly file listing with hashes of key system folders on servers and a sample of desktops. Comparing a current listing with the baseline shows files added, removed or changed.

The baseline is only useful if it is trustworthy, so Alder Falls stores listings on the central server, hashes each one and keeps several weeks. CLERK-03 was in the desktop sample, which is why a comparison with the 1 May listing was possible at all. Desktops outside the sample would offer no such comparison.

Lab — before/after comparison

"""Compare two synthetic directory listings (before/after snapshot)."""
before = {"C:/Users/jdiaz/Documents/permits.xlsx": "a1f3", "C:/Windows/System32/svc.exe": "9c2e",
          "C:/Users/jdiaz/Desktop/notes.txt": "77b0"}
after = {"C:/Users/jdiaz/Documents/permits.xlsx": "a1f3", "C:/Windows/System32/svc.exe": "4d18",
         "C:/Users/jdiaz/Desktop/notes.txt": "77b0", "C:/ProgramData/upd/helper.exe": "e5aa"}
print("added:", sorted(set(after) - set(before)))
print("removed:", sorted(set(before) - set(after)))
print("changed:", sorted(p for p in before if p in after and before[p] != after[p]))

Run with python3 lab_diff.py. Verified output:

added: ['C:/ProgramData/upd/helper.exe']
removed: []
changed: ['C:/Windows/System32/svc.exe']

6.3 Reading the result

One file was added — C:/ProgramData/upd/helper.exe — and one system file changed: C:/Windows/System32/svc.exe has a different hash. Nothing was removed. A changed system binary is especially significant: legitimate updates change system files too, so Jonah checks whether an update ran; none was scheduled.

Jonah notes what the comparison cannot say: when between 1 May and the incident the files changed, or what they do. The baseline gives a before and an after; the timeline and an analyst's examination must fill in the rest.

6.4 Virtualization

Servers at Alder Falls are virtual machines. Snapshots preserve disk and memory state without touching the guest; the snapshot files can be copied and hashed for analysis.

For an investigation, a snapshot taken at the right moment lets Renata examine a server's state without logging into it, which avoids changing its logs and files. The snapshot is a copy: it must be exported, hashed and recorded with who took it and when, so its integrity can be shown later. The guest's own clock and logs are untouched.

6.5 Snapshot cautions

Snapshots consume storage and, if left running, slow systems. Export and hash them, then follow retention rules.

A snapshot left attached to a running VM also grows as the guest writes, and some platforms merge it back on deletion. Jonah's checklist says: take the snapshot, export it to evidence storage, hash the export, record it, and only then remove the live snapshot with the system owner's agreement. The order prevents an accidental merge from destroying the copy. Storage teams should know who to call before deleting old snapshots.

6.6 Containers

Containers are short-lived; logs must be shipped centrally or they vanish when containers stop.

For investigators this means container evidence depends on preparation. If a container that ran suspicious code has already stopped and its logs were not shipped, there may be nothing left to examine except the image it was built from. Alder Falls does not run containers yet, but Jonah notes the requirement for the readiness plan before any are deployed. Logs shipped centrally survive the container's end and keep their timestamps.

6.7 Recording

Each comparison records the baseline date, current listing time, and tool used.

Jonah's comparison report for CLERK-03 names the 1 May baseline, the time of the current listing, the script and its version, so another analyst can repeat it exactly. Without those details, "svc.exe changed" is an assertion; with them it is a reproducible measurement that a reviewer can check. The same details belong on every derived listing stored in the case folder, so a later reader can find the inputs and repeat the comparison without asking Jonah.

Worked example

Jonah reports: "Compared with the 1 May baseline, CLERK-03 has one new executable (helper.exe in ProgramData\upd) and a changed svc.exe in System32. No update was scheduled for that period." Renata requests both files be preserved for analysis.

Synthetic case. The listings are generated by the lab script.

Errors and limits

Baselines are only as good as their coverage and age; a week-old baseline misses changes that came and went in between.

Exercises

Synthesis

Baselines and snapshots let technologists detect and preserve changes with minimal disturbance.

Continue studying — chapter 06 of 30

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →