## Chapter 12 — A set difference stores no clock ### Lesson map Lesson 12. Map, example, EX058. ```mermaid flowchart TD L["len baseline 3, len today 5"] --> N["Two NEW names"] N --> C{"Does any printed line contain 13:48?"} C -->|No| P["The fit to 13:48 is a note"] ``` Lengths and names are in the print. The download clock is not. ### Logical drawing ```text baseline: 3 today: 5 NEW: AlertPopup NEW: TemplateUpdater absent from those three lines 13:48 13:46 Tuesday ``` ### Learning outcomes After this chapter, you should be able to: 1. Read the length line as two integers. 2. Say where 13:48 lives. 3. Refuse a lab column that the script never printed. ### 12.1 The fit to 13:48 is prose. The print has names and lengths. `print("baseline:", len(baseline), "today:", len(today))` writes two integers. The baseline set has three names, and `today` has five. The difference of those lengths is two, and two NEW lines follow. That arithmetic checks the print against itself. It is not a share of risk, and this chapter does not write it as a fraction of five. Neither integer is a clock. `AlertPopup` and `TemplateUpdater` are strings. The set that held them cannot store the download time, because a set of strings has no timestamp field. Priya's note says the two names fit the download at 13:48. That sentence is hers. A reader who looks only at the three lab lines cannot recover 13:48, 13:46, or the word Tuesday from them. NIST SP 800-86 is about bringing forensic technique into incident response, including writing down where a fact came from. Here the lengths and the names come from the script. The clock comes from the file-time note in the earlier chapter. Mixing them into one "lab result" makes the script look wiser than it is. | Fact | Where it is stored | |---|---| | 3 and 5 | The length line | | Two new names | The NEW lines | | 13:48 | Priya's note, not the script | | A fraction of the five names | Not printed | ### 12.2 Worked example | Offered sentence | Source | Decision | |---|---|---| | "The length line says 3 and 5." | The print | Keep | | "Two NEW lines follow." | The print | Keep | | "The script printed 13:48 beside AlertPopup." | No such column | Refuse | | "Two of five startup names were malicious." | A fraction the file does not print | Refuse | > **Synthetic case.** The startup print is three lines. ### Errors and limits Do not glue the download clock onto a line that has no clock. ### Apply - **EX058 — Where the clock lives.** The startup print shows lengths 3 and 5 and two NEW names. Which of those lines contains 13:48? *Rubric:* 3 = none; 13:48 is in the notes; the script stores names and lengths only; do not print a fraction of five;; 2 = the clock is prose and the print has no time;; 1 = one line;; 0 = none. ### Continue studying — lesson 12 (chapter 12 of 20) [← Chapter 11](#ch-11) · [Course chapter index](../SUBJECTS.md) · [Chapter 13 →](#ch-13) Continue to the next authored lesson. ## Worked answers **EX058.** None of the lines. 13:48 is in the notes. The script stores names and lengths only. Do not print a fraction of five.