An empty MISSING loop still ran | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 13. Map, example, EX059.

flowchart TD
  B["baseline minus today"] --> E["Empty set"]
  E --> L["The MISSING loop runs"]
  L --> Z["Zero lines"]
  Z --> Q{"Were OneDrive, AudioService, PrinterHelper removed?"}
  Q -->|No| K["They are still in today"]

No MISSING line is a result. It is not a loop that was skipped.

Logical drawing

still in both sets
  OneDrive
  AudioService
  PrinterHelper
baseline minus today
  empty
printed under MISSING
  nothing

Learning outcomes

After this chapter, you should be able to:

Name the three baseline programs that remain.
Explain an empty difference.
Refuse an invented MISSING line.

13.1 The second loop prints once per leftover name. There are none.

After the NEW lines, the script walks sorted(baseline - today) and prints MISSING: plus the name. baseline - today holds names that were in the saved set and are absent from today. OneDrive, AudioService, and PrinterHelper are members of both sets, so that difference is empty. sorted of an empty set is an empty sequence. The loop body never runs, and the page shows no MISSING line.

An empty result is still information. Some harmful programs disable or replace a normal startup name. Priya's note records that none of the three baseline names was removed. She gets that from the absence, not from a sentence the script failed to emit. Adding a fake MISSING line "for completeness" would claim a removal that the sets contradict.

The length line agrees. Baseline length 3 and today length 5, with two names added and zero names removed, is 3 + 2 - 0 = 5. That check uses only the sets. It does not require a clock, and it does not require opening either new program.

Lesson table; scroll horizontally to read all columns →

Set fact	Print
Name in both sets	No MISSING line
Name only in `today`	A NEW line
Name only in `baseline`	A MISSING line, and this run has none
An invented removal	Not supported

13.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered reading	What the sets support	Decision
Three baseline names remain	They are members of `today`	Keep
The MISSING loop printed nothing	The difference is empty	Keep
"PrinterHelper was replaced."	It is still in `today`	Refuse
"Add MISSING: none so the page looks finished."	That word is not a member	Refuse

Synthetic case. The baseline three are still present.

Errors and limits

Do not fill an empty difference with a comforting extra line.

Apply

EX059 — Empty difference. Why is there no MISSING line, and which baseline names remain?
Show marking criteria
Rubric: 3 = OneDrive, AudioService, and PrinterHelper are still in today; the difference is empty; the loop ran and printed nothing;; 2 = the three names remain and nothing was missing;; 1 = one name;; 0 = none.