The Morris Worm (1988) — The Catalyst that Birthed Cyber Forensics

Robert Tappan Morris released the first major internet worm infecting ~6,000 machines (10% of the internet). Investigators had no tools, no protocols, and no chain-of-custody concepts.

## Background

Robert Tappan Morris released the first major internet worm infecting ~6,000 machines (10% of the internet). Investigators had no tools, no protocols, and no chain-of-custody concepts.

## Learning Objective
Understand why digital forensics was born and evolved from basic data recovery to a structured science.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The Morris Worm (1988) — The Catalyst that Birthed Cyber Forensics
- Year: 1988
- Domain: Cyber Forensics
- Difficulty: Beginner

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-morris-worm

## Investigation Questions

1. How did the Morris Worm propagate across the 1988 internet?
2. Why did investigators lack standard operating procedures in 1988?
3. What forensic principles were born from this case?
4. Would you pull the plug or preserve the network state? Justify.
5. How would a modern DFIR team handle the same scenario differently?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
If you were the first responder in 1988, would you pull the plug or preserve the network state? Pulling the plug loses volatile evidence; they learned the hard way.

## Forensic Takeaway
This case proved we need standard operating procedures for seizing computers, avoiding tampering, and bit-for-bit imaging. It birthed the 'preserve, don't poke' mantra.