Two labs are not one script | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 14. Map, example, EX060.

flowchart TD
  H["lab_hashcheck.py"] --> R1["Three filename rows"]
  S["lab_startup.py"] --> R2["Lengths and two NEW lines"]
  R1 --> N["Priya's note may sit beside both"]
  R2 --> N
  N --> Q{"Did either script print the other script's rows?"}
  Q -->|No| K["Keep the outputs apart"]

The note may place the results side by side. The files do not.

Logical drawing

hash script sees
  three names and three byte strings
startup script sees
  two sets of startup names
neither script sees
  the other script's variables

Learning outcomes

After this chapter, you should be able to:

Name the two scripts and their outputs.
Keep a prefix out of the startup print.
Refuse a merged lab that neither file produced.

14.1 Each file has its own names. The case note is a third page.

lab_hashcheck.py walks a dict of filenames and byte strings. Its output is three rows: a prefix and either no match or the adware label. It never builds a set called baseline, and it never prints NEW. lab_startup.py walks two sets of startup names. Its output is a length line and two NEW lines. It never calls hashlib, and it never prints 0edf30e2fa30, 3e5d3b83407c, or ffcab6e8630a.

Priya's notebook is allowed to mention both results in one paragraph, because she ran both checks and she labels the sources. That paragraph is not a third script. A sentence such as "the prefix caused AlertPopup" moves from two observations to a cause. The observations can sit together. The cause is not a column in either print. She also does not open the new programs. Their names, plus the hash label, are what she uses.

There is no hidden third lab in this course. A classmate who pastes the prefix onto a NEW line has invented a tool. NIST's Computer Forensics Tool Testing program is how some forensic tools are examined. These two classroom scripts have not been submitted to it, and this chapter does not claim they were.

Lesson table; scroll horizontally to read all columns →

Script	Prints	Does not print
`lab_hashcheck.py`	Three filename rows	Startup names
`lab_startup.py`	Lengths and NEW lines	Hex prefixes
The notebook	Both, with sources	A fused column

14.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered page	What it mixes	Decision
Hash print quoted alone	One script	Keep
Startup print quoted alone	The other script	Keep
"3e5d3b83407c NEW: AlertPopup"	A column neither file has	Refuse
"One script printed both outputs."	Two files	Refuse

Synthetic case. Two standard-library files, two embedded outputs.

Errors and limits

Do not weld the prefix to a startup name and call the weld a lab.

Apply

EX060 — Two outputs. Can the startup print include 3e5d3b83407c, and can the hash print include NEW: AlertPopup?
Show marking criteria
Rubric: 3 = no; each script prints only its own rows; the notebook may cite both with sources; neither file contains the other file's columns;; 2 = the outputs stay separate;; 1 = one script;; 0 = none.