15:10 is a clean-computer clock | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 17. Map, example, EX063.

flowchart TD
  S["Usual sign-ins only"] --> C["Password changed anyway"]
  C --> P["15:10 Wednesday, clean computer"]
  P --> M["Two-step on"]
  M --> B["Do not save the new password in the browser"]
  P --> Q{"Does 15:10 prove a capture was seen?"}
  Q -->|No| K["The reason is a precaution"]

The clock is a precaution taken off the laptop. It is not a sighting.

Logical drawing

observed
  usual sign-ins only
done at 15:10 Wednesday
  new password, typed on a clean computer
  two-step turned on
instruction
  do not store that password in the browser
not observed
  a capture of keystrokes
  a count of the usual sign-ins

Learning outcomes

After this chapter, you should be able to:

Place 15:10 on a clean computer.
Separate a precaution from a sighting.
Refuse a sign-in count that was never printed.

17.1 The password moved because the laptop was the wrong keyboard.

The email history showed only Tomás's usual sign-ins. Priya still changes the password, and she does it from a clean computer at 15:10 on Wednesday. The reason is that a program on FB-LAP-02 might record what is typed. A new password entered on that keyboard could be captured at once. Two-step sign-in is turned on in the same action, so a password alone would not be enough later. Tomás is told not to save the new password in the browser.

The reason is not a finding. Nobody in this case observed a capture. The sentence "a keylogger was running" would upgrade a precaution into an artefact the notes do not contain. The labs do not see this action at all: the hash script has no account field, and the startup script has no password field. 15:10 is a notebook clock.

"Usual" is also not a number. The book does not say how many ordinary sign-ins were on the page. A later summary that prints a count has invented a tally. The change stands even though the history looked ordinary, which is a different fact from "the history proved misuse" and a different fact from "the history was ignored".

Lesson table; scroll horizontally to read all columns →

Statement	Status
Usual sign-ins only	Observed
15:10, clean computer, two-step on	Done
New password left out of the browser	Instructed
A capture was seen	Not in the notes
A count of usual sign-ins	Not printed

17.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered sentence	What it adds	Decision
"15:10 Wednesday, clean computer, two-step on."	The note	Keep
"History was usual, and the password changed anyway."	Both facts	Keep
"A keylogger captured the attempt."	A sighting	Refuse
"Four usual sign-ins, all from the office."	A tally and a place	Refuse

Synthetic case. The email action is Wednesday, off FB-LAP-02.

Errors and limits

Do not narrate a capture that the precaution was designed to avoid.

Apply

EX063 — Clean keyboard. Why was the password changed on a clean computer at 15:10, and what was not observed?
Show marking criteria
Rubric: 3 = typing on FB-LAP-02 might be captured; 15:10 Wednesday is the clean-computer clock; two-step was turned on; no capture was observed; no count of usual sign-ins is printed;; 2 = the clock is a precaution and no capture was seen;; 1 = the time only;; 0 = none.