A set difference stores no clock | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 12. Map, example, EX058.

flowchart TD
  L["len baseline 3, len today 5"] --> N["Two NEW names"]
  N --> C{"Does any printed line contain 13:48?"}
  C -->|No| P["The fit to 13:48 is a note"]

Lengths and names are in the print. The download clock is not.

Logical drawing

baseline: 3 today: 5
NEW: AlertPopup
NEW: TemplateUpdater
absent from those three lines
  13:48
  13:46
  Tuesday

Learning outcomes

After this chapter, you should be able to:

Read the length line as two integers.
Say where 13:48 lives.
Refuse a lab column that the script never printed.

12.1 The fit to 13:48 is prose. The print has names and lengths.

print("baseline:", len(baseline), "today:", len(today)) writes two integers. The baseline set has three names, and today has five. The difference of those lengths is two, and two NEW lines follow. That arithmetic checks the print against itself. It is not a share of risk, and this chapter does not write it as a fraction of five.

Neither integer is a clock. AlertPopup and TemplateUpdater are strings. The set that held them cannot store the download time, because a set of strings has no timestamp field. Priya's note says the two names fit the download at 13:48. That sentence is hers. A reader who looks only at the three lab lines cannot recover 13:48, 13:46, or the word Tuesday from them.

NIST SP 800-86 is about bringing forensic technique into incident response, including writing down where a fact came from. Here the lengths and the names come from the script. The clock comes from the file-time note in the earlier chapter. Mixing them into one "lab result" makes the script look wiser than it is.

Lesson table; scroll horizontally to read all columns →

Fact	Where it is stored
3 and 5	The length line
Two new names	The NEW lines
13:48	Priya's note, not the script
A fraction of the five names	Not printed

12.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered sentence	Source	Decision
"The length line says 3 and 5."	The print	Keep
"Two NEW lines follow."	The print	Keep
"The script printed 13:48 beside AlertPopup."	No such column	Refuse
"Two of five startup names were malicious."	A fraction the file does not print	Refuse

Synthetic case. The startup print is three lines.

Errors and limits

Do not glue the download clock onto a line that has no clock.

Apply

EX058 — Where the clock lives. The startup print shows lengths 3 and 5 and two NEW names. Which of those lines contains 13:48?
Show marking criteria
Rubric: 3 = none; 13:48 is in the notes; the script stores names and lengths only; do not print a fraction of five;; 2 = the clock is prose and the print has no time;; 1 = one line;; 0 = none.