Digital Forensics and Malware Analysis
Digital Forensics and Malware Analysis tests evidence acquisition, artifact interpretation, and safe malware triage - enough to answer what happened on a host and what a sample does.
Core rules
- Acquire with a write blocker, verify SHA-256 before and after, and document the tool and version. Common formats are raw dd and E01.
- Know high-value Windows artifacts: $MFT and $UsnJrnl for file activity, Prefetch for execution, Amcache and ShimCache for program presence, event logs for logons and services, LNK and Jump Lists for user activity, $Recycle.Bin for deletions.
- In memory forensics, Volatility plugins such as pslist, pstree, cmdline, netscan, malfind, and dlllist answer process, network, and injection questions.
- For malware, triage statically first: hashes, strings, PE headers, imports, sections, signatures. Then detonate in an isolated VM with Procmon, Regshot, and full packet capture.
Worked example
A suspicious executable has a recent compile timestamp but imports VirtualAllocEx and WriteProcessMemory. Reasoning: those imports suggest process injection, not a benign updater. Before running it, capture a baseline, snapshot the VM, and monitor child processes and outbound connections. Confirm with memory analysis of the infected host.
Traps
- Executing a sample on the analysis workstation or a networked VM.
- Relying on the PE compile timestamp, which is trivially forged.
- Skipping hash verification, which undermines evidentiary value.
- Interpreting Prefetch as proof of malicious execution rather than proof of execution.
- Analyzing a packed sample without noting the packer or unpacking first.