Two minutes is 13:46 to 13:48 | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 10. Map, example, EX056.

flowchart TD
  A["13:46 advert"] --> B["13:48 file"]
  B --> G["two minutes, same afternoon"]
  R["14:20 report"] --> D["14:25 Wi-Fi off"]
  D --> P["14:30 permission"]
  G --> Q{"Is about 13:50 an exact minute?"}
  Q -->|No| K["Do not subtract it"]

Some pairs subtract cleanly. The remembered phrase does not.

Logical drawing

exact, Tuesday
  13:46 to 13:48 = 2 minutes
  14:20 to 14:25 = 5 minutes
  14:25 to 14:30 = 5 minutes
  14:20 to 14:30 = 10 minutes
not exact
  about 13:50
other day
  Wednesday 15:10

Learning outcomes

After this chapter, you should be able to:

Subtract the exact Tuesday pairs.
Leave "about 13:50" unsubtracted.
Refuse an hour-count from Tuesday afternoon to Wednesday 15:10.

10.1 Exact pairs are both written as clock times. "About" is not.

13:48 minus 13:46 is two minutes. That pair is the advert page and then the file. The opening chapters treat a two-minute gap as a click followed by a download, and an hour-long gap as a hint that something else delivered the file. This gap is the short one. The arithmetic uses the two checked clocks only.

14:25 minus 14:20 is five minutes, from the report to the Wi-Fi disconnect. 14:30 minus 14:25 is five minutes, from the disconnect to Ana's permission. 14:30 minus 14:20 is ten minutes for the whole first response. Those three results are the same afternoon, and each endpoint is a time Priya wrote without the word "about".

"About 13:50" cannot be subtracted from 13:48 to produce a precise error. The word "about" is the reason. A note that prints "memory was wrong by two minutes" has invented a precision Tomás did not claim. Wednesday 15:10 is the password change on the next day. The night between Tuesday and Wednesday is not given as a count of hours in this book, so this chapter does not print one.

Lesson table; scroll horizontally to read all columns →

Pair	Result this chapter will state
13:46 to 13:48	2 minutes
14:20 to 14:25	5 minutes
14:25 to 14:30	5 minutes
about 13:50 against 13:48	Not an exact difference
Tuesday afternoon to Wednesday 15:10	Not an hour-count in this book

10.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered sentence	Arithmetic	Decision
"Advert to file is two minutes."	13:48 minus 13:46	Keep
"Report to permission is ten minutes."	14:30 minus 14:20	Keep
"Memory missed by exactly two minutes."	"About" blocks the subtraction	Refuse
"Fifteen hours passed before the password change."	No such count is printed	Refuse

Synthetic case. The clocks are the ones already in Priya's notes.

Errors and limits

Do not turn an approximate memory into an exact error bar.

Apply

EX056 — Which gaps are exact. Compute the advert-to-file gap and the report-to-permission gap. Is "about 13:50" an exact third gap, and is an hour-count to Wednesday 15:10 printed?
Show marking criteria
Rubric: 3 = two minutes and ten minutes; about 13:50 is not an exact gap; no hour-count to Wednesday is printed;; 2 = the two exact gaps and the refused pair;; 1 = one gap;; 0 = none.