<a id="ch-15"></a>

## Chapter 15 — Thursday is a sentence, not a column

<!-- open-cyber-academy:lesson-figures:start ch-15 -->
### Lesson map

Lesson 15. Map, example, EX061.

```mermaid
flowchart TD
  U["USB: notes, hashes, comparison"] --> R["Thursday restore, in the report"]
  R --> Q{"Does either lab print Thursday?"}
  Q -->|No| K["The day stays prose"]
  U --> X["The installer stays off the stick"]
```

The restore is a decision recorded in words. The scripts have no day field.

### Logical drawing

```text
saved before the restore
  notes
  three hash results
  startup comparison
not saved on that stick
  the installer
report sentence
  restored Thursday from the clean image
lab columns
  no weekday
```
<!-- open-cyber-academy:lesson-figures:end ch-15 -->

### Learning outcomes

After this chapter, you should be able to:

1. Say what was copied before the restore.
2. Keep Thursday out of both lab prints.
3. Refuse a copy of the installer on the USB stick.

### 15.1 The image restore is Ana's decision. The labs do not timestamp it.

The report says the laptop was restored on Thursday from the clean setup image. Neither script has a weekday field, a path to an image, or a success flag. Searching the hash print or the startup print for the word Thursday fails. The day lives in the report sentence, next to the other actions: the password change and two-step sign-in.

Before that restore, unsaved disk contents would be gone. Priya copies her notes, the three hash results, and the startup comparison. Tomás confirms his documents are on the shared drive, not only on the laptop. The installer is not one of the copied things. Putting it on the stick would carry the suspicious file away from the laptop she is about to rebuild, which her own rules already refuse.

Choosing a full image, rather than deleting the two new names by hand, is the decision in the earlier chapter: a one-by-one removal might miss something the startup list did not show. That reasoning stays a decision. It does not become a fourth column under the NEW lines.

| Item | Where Thursday can appear |
|---|---|
| Report sentence | Yes |
| Hash print | No |
| Startup print | No |
| Installer on the USB stick | No, on any day |

### 15.2 Worked example

| Offered line | Where it belongs | Decision |
|---|---|---|
| "Restored Thursday from the clean image." | The report | Keep |
| "USB held notes, three hash results, and the comparison." | The pre-restore copy | Keep |
| "NEW: Thursday" | Not a startup name | Refuse |
| "The stick also holds FreeTemplates_setup.exe." | The installer stays off | Refuse |

> **Synthetic case.** Thursday is a report word about FB-LAP-02.

### Errors and limits

Do not promote a weekday into a lab field so the print looks dated.

### Apply

- **EX061 — What is prose.** Where does Thursday appear, what was saved beforehand, and is the installer on the USB stick? *Rubric:* 3 = Thursday is only in the report; the stick holds notes, the three hash results, and the startup comparison; the installer is not copied; neither lab prints the day;; 2 = the day is prose and the installer stays off the stick;; 1 = one item;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-15 -->
### Continue studying — lesson 15 (chapter 15 of 20)

[← Chapter 14](#ch-14) · [Course chapter index](../SUBJECTS.md) · [Chapter 16 →](#ch-16)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex061"></a>
**EX061.** Thursday is only in the report. The stick holds notes, the three hash results, and the startup comparison. The installer is not copied. Neither lab prints the day.