Chapter 16 — Investigation methods across multiple data sources

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["16.1 Questions and hypotheses"]
  N2["16.2 Pivoting"]
  N3["16.3 Scoping outward"]
  N4["16.5 Interviews"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["16.1 Questions and hypotheses"]
  N2["16.2 Pivoting"]
  N3["16.3 Scoping outward"]
  N4["16.5 Interviews"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]

[Learning outcomes and connection]
    |
    v
[16.1 Questions and hypotheses]
    |
    v
[16.2 Pivoting]
    |
    v
[16.3 Scoping outward]
    |
    v
[16.5 Interviews]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes and connection

You will be able to (1) frame investigation questions as testable hypotheses; (2) pivot across identity, endpoint, network and cloud data using shared keys; and (3) document findings with their supporting and contradicting evidence. Chapter 15 built one timeline; this chapter teaches the method for growing a case across sources without losing rigour.

16.1 Questions and hypotheses

Start from the scope question and list plausible explanations. For FCS-214: H1 the clerk read the archive for work; H2 an external actor used her credentials; H3 a malicious insider used her account. For each hypothesis, ask what evidence would be expected if it were true and what would contradict it. Chamberlin's "multiple working hypotheses" and Platt's "strong inference" are old but still the right discipline: seek evidence that discriminates, not evidence that merely fits your favourite. In FCS-214 this approach worked: the training-session interview and the spraying evidence discriminated between the hypotheses.

16.2 Pivoting

A pivot follows a shared key from one source to another: account id from IdP to file server; source address from IdP to edge and VPN; host name from endpoint to inventory; file hash from endpoint to threat information; access key id from cloud audit to data-read logs. Record each pivot (from, key, to, query, result) so the path can be repeated. In FCS-214, four recorded pivots led from one source address to 14 sprayed accounts, a second compromised account and a hidden inbox rule. Because each pivot was written down, a reviewer could repeat it and reach the same accounts.

16.3 Scoping outward

When a hypothesis gains support, ask what else the actor could reach: other accounts used from the same address; other hosts with the same persistence; other buckets accessed with the same key. This is where inventory dependencies (Chapter 11) guide the search. In FCS-214, scoping outward found hr-assist-5: the same source address had sprayed 14 accounts, and one of them had a successful sign-in without an MFA prompt because a legacy protocol was allowed. Inventory then showed which services that account could reach, so the case scope widened with a reason. The legacy protocols were scheduled for disablement as a result.

16.4 Worked example (synthetic): FCS-214 continued

Pivot 1: source 198.51.100.23 in IdP logs over 30 days → also used for failed sign-ins against 14 other staff accounts on 9–10 May (password spraying). Pivot 2: those 14 accounts in IdP success logs → one more success, hr-assist-5, on 10 May, no MFA prompt because a legacy protocol was allowed. Pivot 3: hr-assist-5 in mailbox audit → an inbox rule hiding messages from the service desk. Pivot 4: the clerk's interview (with her manager, recorded) → she was in a training session at 14:00–15:00 on 11 May with her laptop closed; her approval of a push at 14:02 came from her phone during the session.

Hypothesis table:

Lesson table; scroll horizontally to read all columns →

H2 is best supported. Scope expanded to include hr-assist-5; legacy protocols were scheduled for disablement.

16.5 Interviews

Interviewing staff is part of investigation but involves people's rights and employment. Fernmoor's rule: interviews about a staff member's account are arranged with their manager or HR, are factual and non-accusatory, and are recorded in the case. In FCS-214, the clerk was interviewed with her manager present and the interview was recorded in the case. Her account of being in a training session was a factual statement that could be checked, and it supported the external-actor hypothesis without accusing anyone. HR would have been involved if the evidence had pointed to an insider.

16.6 Common errors and limits

• Seeking only confirming evidence.
• Unrecorded pivots that nobody can repeat.
• Treating an address as one actor without checking shared infrastructure.
• Concluding intent from technical evidence alone.

FCS-214's hypothesis table guards against the first error by recording which evidence was inconsistent with each explanation, not only which fitted. Recorded pivots answer the second. The analysts checked whether 198.51.100.23 could be shared infrastructure before treating it as one actor, and the case concluded nothing about intent from the logs alone; that was left to the interview and to people with authority to judge it.

Exercises — chapter 16

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX046 — Expected evidence. Steps: for the FCS-214 hypotheses H1–H3, list two items of evidence each would predict. Rubric: 3 = two discriminating predictions for each; 2 = some non-discriminating; 1 = one hypothesis only; 0 = none.

EX047 — Pivot log. Steps: write the pivot log for pivots 1–3. Rubric: 3 = from, key, to, query, result for each; 2 = missing queries; 1 = narrative; 0 = none.

EX048 — Interview plan. Steps: write five neutral questions for the clerk interview. Rubric: 3 = factual, open, non-accusatory, cover location, devices, prompts received, use of archive, other observations; 2 = one leading question; 1 = accusatory; 0 = none.

Chapter synthesis

Investigate with multiple hypotheses and discriminating evidence; pivot across sources by shared keys and log every pivot; scope outward using dependencies; and handle interviews fairly and on the record.