A student simulates an activity that is interesting from a computer forensics perspective (eg. a malware infection), and then performs a step by step investigation, describes clues etc.
Interesting activities: malware infections, network attacks, malicious user behaviour (eg. deleting/editing important files)…
Example: Case study - forensic analysis of a computer infected with Locky ransomware
A student starts a virtual machine, infects it with Locky ransomwarem, creates a memory dump, disk image and records network traffic and then uses them for a forensic analysis while explaining clues left by the ransomware.
Eg. “this is the network traffic of Locky communicating with the C&C server to receive the encryption key, this is the Locky process (in the memory dump), its PID is <pid>, at the moment of memory dump it had <the following files> open, <this> is the Locky executable file (on disk)” etc.
And in the end, conclusions based on found clues - at 12:35 the ransomware was started, at 12:37 it started encrypting files (file abc.doc was encrypted first), at 12:40 the encryption process has ended and the ransom note was shown…
-
Of course it is not necessary to do reverse engineering or deep analysis.
Important - caution is required when handling malware so you don't infect your own computer. It is necessary to have backups of all important data and to only run mawlare in “clean” virtual machines (where you didn't log in to any websites and you have no files there etc.)