Nine Ordering Principles From One Linux Course

Introduction

LX0.7 ordered an entire investigation by what expires first. That is one answer, it is right for the first ten minutes, and it is not the answer any individual module of this course arrived at.

Each module works a different kind of evidence, and each one derived its own rule for what has to happen first. Laid side by side the nine rules disagree, several of them would be actively wrong applied elsewhere, and that is the most useful thing about them.

You will finish able to state the nine, say why none is general, and recognize the question they are all answers to.

The list below was read from those modules rather than recalled, which matters here more than usual. A summary of nine principles assembled from memory is exactly the kind of artifact that drifts, and two of the nine turned out to say something about each other that needed checking.

Every module ends by naming the property that decided its own order.

$ cat nine-principles.txt
  M1  volatility        what disappears soonest goes first
  M2  cost              among things that decay alike, take the cheap ones first
  M3  narrowing         each reading should make the next search smaller
  M4  external latency  what somebody else must answer is requested first
  M5  dependency        collection is unordered; interpretation is a chain
  M6  coverage          enumerate every trigger before resolving any of them
  M7  location          the host is the subject of the question, not its source
  M8  reachability      every durable artifact is reached through a volatile one
  M9  participation     the collector is part of the system under measurement

Nine modules and nine different properties. No two of them would produce the same sequence given identical evidence. Not one of them is a restatement of another, and no two would produce the same sequence given the same evidence.

That is worth testing rather than taking on trust, and section seven does it. Each principle names a condition under which it produces a useless order, and no two of those conditions are the same either.

They are also not arranged by importance. The ninth is not more advanced than the first; it is the answer a different kind of evidence required, and the first is still correct everywhere it applies.

The numbering is chronological, following the modules that produced them, and nothing else. Reading it as a progression from simple to sophisticated would suggest the ninth supersedes the first, and on a disk image the first is right and the ninth does not apply at all.

Reading the first and the sixth against each other is the clearest way to see that these are not rules.

$ ./compare-principles.sh --a M1 --b M6
  M1 volatility   take the thing most likely to vanish, first
                  a hit is a reason to act immediately
  M6 coverage     enumerate every location before resolving anything
                  a hit is a reason to keep going

  applied to a persistence search
    M1 order      whichever mechanism might change soonest
    M6 order      all 13 present mechanisms, then judge
  applied to a live host
    M1 order      the process table, now
    M6 order      would lose the process table while enumerating

Each is wrong in the other's domain. Applying either one outside its material produces a confident, orderly, useless sequence. Persistence mechanisms do not decay meaningfully, so ordering them by volatility is ordering by an irrelevance; a live process table does decay, so enumerating everything before acting loses it.

Useless rather than visibly broken is the important word. Neither misapplication produces an error, a failure or an empty result; both produce a completed piece of work that answered a question the evidence was not posing.

That is what makes them principles rather than procedure. A rule that works everywhere would have to be vague enough to be useless, and these are specific because each was derived from one kind of material.

A procedure can be followed without understanding the material. A principle has to be matched to it, which is more work and is the only thing that survives meeting evidence nobody wrote a procedure for.

Framing the common element as a question rather than as a meta-principle is deliberate. A tenth rule saying choose the right rule would be true, unfalsifiable and no help at all, and the four questions in section four are what the habit actually consists of.

That note is the transferable part, and the nine answers are worked examples of it.

Worked examples are worth more than the rule they illustrate, which is the argument for learning all nine rather than only the question. Somebody who has seen nine situations resolve differently recognizes a tenth far faster than somebody holding an abstraction.

There is a third reading of the contradiction worth having, because it explains why both principles feel obviously correct. Volatility and coverage answer different questions that sound like the same question.

Volatility answers what should I do next given that something is disappearing. Coverage answers when am I allowed to stop, and a search can be governed by one, the other, or both at once on a host where some evidence decays and some does not.

Seen that way they do not really contradict; they were simply both stated as ordering rules, which is the form a module ending naturally reaches for. The contradiction is in the phrasing rather than in the ideas, and noticing that is more useful than choosing between them.

Seven of the nine describe properties of evidence. Two describe the person examining it, and they are not the same claim.

That split is worth carrying because it changes what a principle asks of you. Seven of them are satisfied by understanding the material well enough, and two are satisfied only by changing how you work.

The sixth is about how you search. Enumerate every trigger before resolving any of them, because a search that resolves as it goes will stop when one resolution is satisfying, which is a statement about attention rather than about material.

Its failure mode is entirely internal. Nothing about the evidence misleads anybody; the search simply stops at a point that feels like an answer, and the remaining locations are never examined because nobody decided not to examine them.

The ninth is about what examining costs. The collector is part of the system under measurement, so reading the host changes it, and the order has to account for what collecting does as well as for what waiting does.

Its failure mode is entirely external and measurable. Forks appear in a counter, access times move, the page cache fills with what you read, and none of it depends on how carefully anybody was paying attention.

$ ./compare-principles.sh --a M6 --b M9
  M6 coverage        about the investigator's ATTENTION
                     the evidence is unchanged; your search stops too early
  M9 participation   about the investigator's EFFECT
                     the evidence is changed; your reading alters the host
  overlap            both concern the investigator. Neither implies the other.
  note               M6 states it is the only such principle. M9 postdates it.

Both are about the investigator and neither follows from the other. A collection can satisfy one completely and fail the other completely. A search can be perfectly thorough and still contaminate what it reads, and a collection can leave almost no trace and still stop on its first hit.

The last line is worth flagging. Module six says it is the only principle in the course about the investigator, which was true when it was written and is not now, and a reader meeting both will notice.

Leaving it unflagged was the alternative and it is worse. A reader who meets the sixth principle after the ninth will notice the contradiction themselves, and a course that quietly works around its own inconsistency has told them something about how carefully it was assembled.

Drawing all nine on one row under a single question is the shape worth keeping. The row is the answers and the bar above it is the only part that transfers, which is difficult to convey in a list where every item looks equally portable.

The two highlighted boxes are at opposite ends of the row. Nothing about their positions is meaningful; they were derived three modules apart from completely different material and arrived at the same subject from different directions.

Their separation is also why the inconsistency survived. Three modules apart, in different material, neither author had the other in view, and the claim only becomes checkable once somebody lays all nine out together.

Running the questions explicitly is worth seeing before the exercise, because the selection is usually made without noticing. A responder reaches for a principle in about a second, and writing the five answers down is what turns that reflex into something checkable.

One framing before the exercise. Volatility is the principle everybody meets first and the one most likely to be reached for by default, which makes misapplying it the ordinary error rather than a careless one. The responder in the scenario used a correct rule on evidence it does not describe.

$ ./which-principle.sh --evidence 'persistence mechanisms on a live host'
  does anything expire?              no, these are files
  does reading change it?            reading a file sets an access time: minor
  can one reading shrink the next?   no, the mechanisms are independent
  is the set finite and enumerable?  YES, 13 present on this host
  does somebody else hold part?      no
  governs here                       M6 coverage
  does NOT govern                    M1 volatility: nothing here decays

Seven lines and one principle selected. The answers took less time to produce than reading them takes. The last row is the one that matters: naming what does not apply is what stops a familiar rule being used where it means nothing.

The exercise above gives you a principle applied outside the module that produced it.

Given an unfamiliar situation, four questions about the evidence narrow it quickly.

The questions are about the material rather than about the investigation, which is what makes them answerable before any work has been done. Nothing in them requires knowing what happened, who was involved or how serious it is.

Does anything here expire. If yes, volatility and reachability are in play and something has a deadline; if no, none of the scarcity principles apply at all and ordering is free.

Does reading it change it. That is the ninth, and it is true of any live system and false of every image, log and archive.

That question is unusual among the five for having a categorical answer. Every live system says yes and every image, log and archive says no, so it is the fastest of the five to resolve and the one most likely to be skipped because it feels obvious.

Five questions reaching seven of the nine. The two they miss are the ones that depend on circumstance rather than material. Location and cost are the two that need the situation rather than the material, which is why they are harder to spot in advance.

Can one reading make the next search smaller. That is narrowing, and it is what turns a large search space into a sequence rather than a sweep.

And does somebody else hold part of the answer. That is latency, it has nothing to do with the evidence on the host, and it is the one most often forgotten entirely.

It is worth asking last and acting on first. Nothing about it affects the host work, and the request goes out before any of it, which is the only principle in the set whose action is disconnected from its position in the reasoning.

Nine is not a complete set, and treating it as a closed one would repeat the exact mistake this whole section is about.

There is a pull toward closure with a list this size. Nine is a satisfying number, the set covers everything the course met, and both of those are facts about the course rather than about investigation.

A new kind of evidence produces a new property. Something with an access cost per query, or a source that degrades when read repeatedly, or evidence held by a party whose cooperation is uncertain would each impose an order none of the nine describes.

Whether a tenth exists is not a question about this course. It is a question about what somebody is looking at, and a body of evidence with a constraint none of the nine names will produce one whether or not anybody writes it down.

The derivation is the same every time. Work the material, notice what constrains the sequence, state it, and check whether the earlier principles apply before assuming any of them do.

Steps two and three carry the weight. Noticing what actually constrained the order rather than what felt natural is the hard part, and checking the existing nine before naming a new one is what keeps the set small enough to be useful.

That is exactly how the ninth arrived. It was not deduced from the eight before it; it appeared when nine finished sections turned out to be mostly about the collector rather than the host, which nobody planned.

Nothing about that process was clever. It was a count of nine finished sections sorted into two piles, and the result was unbalanced enough that it named itself.

$ cat deriving-a-tenth.txt
  1  work the material and produce the readings it supports
  2  ask what actually constrained the order, rather than what felt natural
  3  check the nine: does one of them already describe it
  4  if not, state the new property in one sentence
  5  say plainly which of the nine it replaces, and where
  6  expect it to be wrong somewhere else

Six steps and the third is the one that stops the list growing without cause. A set of principles that only grows is a set nobody can hold in mind. Most new situations are covered by an existing principle, and a tenth is worth naming only when none of the nine fits.

Step five is the other one worth keeping. A new principle that does not say which of the existing nine it replaces, and where, is an addition to a pile rather than a contribution to a set.

One more property of the set worth noticing, because it says something about how the course was built. The ninth principle was the only one that could not have been derived from a single module in isolation.

The other eight came out of working one kind of evidence. This one required finishing nine sections and then counting what they were about, which is a different operation entirely and one nobody can perform while still writing the material.

That is worth knowing if you ever do the same thing. Some properties of a body of work are only visible once it is finished, and the discipline is to go back and count rather than to assume the intention held.

A set of principles derived over time accumulates statements that were true when written.

$ ./audit-claims.sh --scope 'ordering principles'
  M6 states   "the only ordering principle in this course about the investigator"
  written     before M9 existed
  M9 states   "the collector is part of the system under measurement"
  also about  the investigator
  verdict     M6's claim is now false about the course, true about persistence
  safe form   "this principle is about the investigator", not "the only one"

Six lines and the last is the general fix. A positive claim survives the next module; an exclusive one is a statement about everything that has not been written yet.

Module six claims to be the only one about the investigator. That was accurate when it was written and the ninth has since arrived, so the claim is now wrong about the course rather than wrong about persistence.

That is the ordinary fate of an exclusivity claim. Saying this is the only principle that does X is a statement about everything else that exists, and everything else keeps being written.

So the safe form is positive rather than exclusive. This principle is about the investigator is durable; this is the only one about the investigator is a claim that expires the moment somebody derives another.

The same applies to anything written about a growing body of work. Claims about what exists elsewhere age badly, and claims about the thing in front of you do not.

Prefer the narrow claim when writing one down. This principle governs live hosts is checkable against a case; this principle is the important one is a ranking nobody can verify and everybody will argue about.

And noticing it is a reader's job as much as an author's. A course read straight through will surface exactly this kind of drift, and flagging it is more useful than working around it quietly.

A principle is easier to apply correctly once you know the shape of its failure.

Each of the nine breaks in a characteristic way. Knowing the failure is what stops somebody carrying a principle into a domain that looks similar and behaves differently.

That is a stronger statement than saying each has limits. A characteristic failure can be recognized in advance from a property of the material, where an unspecified limit only becomes visible after somebody has wasted an afternoon.

$ cat where-each-fails.txt
  M1 volatility     fails where nothing decays: orders by an irrelevance
  M2 cost           fails where everything is cheap: no discrimination at all
  M3 narrowing      fails where readings are independent: nothing shrinks
  M4 latency        fails where you hold everything: no queue to start
  M5 dependency     fails where interpretation has no chain: a false sequence
  M6 coverage       fails where the set is unbounded: the list never finishes
  M7 location       fails where the host IS the question: the framing inverts
  M8 reachability   fails where nothing volatile gates the durable: no route
  M9 participation  fails on static evidence: reading changes nothing

Nine principles and nine failures. Each failure is characteristic rather than accidental. The last row is the common case for most forensic work, which is why eight modules of this course never needed it.

Reading the column on its own is a fast way to place a new situation. A responder who can say nothing here decays has already eliminated two principles before considering which of the remaining seven fits.

The sixth is the one whose failure is worth watching. An unbounded set makes coverage impossible rather than merely slow, and recognizing that early is the difference between a bounded search and an open-ended one.

Unbounded sets are more common than they look. Every file on a large filesystem, every entry in a high-volume log and every host in a large estate are all sets where completing the enumeration is not available, and a coverage claim has to be scoped to something finite instead.

Practice

There is an exercise worth doing after finishing the course that takes an hour and produces something durable. Take three kinds of evidence your own work involves that this course does not cover, and run the five questions against each.

Most of them land on an existing principle, which is the useful result rather than a disappointing one. Recognizing that a new source is a coverage problem or a latency problem means the ordering is already settled and somebody can get on with the work.

The ones that do not land are worth writing down properly. A constraint none of the nine describes is either a tenth principle or a misunderstanding of the material, and working out which is the most educational hour available once the modules are done.

Take a kind of evidence this course does not cover and ask the four questions of it. Most answers land on one of the nine, which is the useful outcome, and the ones that do not are where a tenth principle would come from.

One thing to carry forward. Every figure and example across these eight sections came from somewhere, and almost none of it came from a real compromised estate, which is a choice worth explaining rather than leaving implicit.

The principles are now established. The environment every example in this course is set in, and why a fictional estate is used rather than a real one, is LX0.9.