## Chapter 19 — The USB stick does not hold the installer ### Lesson map Lesson 19. Map, example, EX065. ```mermaid flowchart TD N["Notes"] --> U["Labelled stick"] H["Three hash results"] --> U C["Startup comparison"] --> U U --> L["Locked with the scope page"] I["Installer"] --> X["Not on the stick"] CL["Client list"] --> X ``` The stick preserves the examination. It does not preserve the program. ### Logical drawing ```text on the stick notes three hash results comparison showing TemplateUpdater and AlertPopup label the case date kept with the scope page absent FreeTemplates_setup.exe the client list ``` ### Learning outcomes After this chapter, you should be able to: 1. List the three classes of record on the stick. 2. Name what was left off. 3. Refuse an examination of another laptop that Ana has not approved. ### 19.1 The stick is a copy of the record. Another laptop still needs a new ask. Priya labels the USB stick with the case date and keeps it locked with the scope page. The contents are her notes, the three hash results, and the startup comparison that shows TemplateUpdater and AlertPopup. If the same adware shows up on another food-bank laptop, those records say what to look for: the prefix behaviour of a known installer name, and the two startup names. They are not a copy of the program. The installer stays off the stick. The client list stays off for a prior reason. She never opened it, so she has nothing from it to copy. "Nothing pointed to data leaving" is the case's observation. If a later case did show data leaving, Ana would decide whether clients must be told. This stick does not smuggle that decision forward by holding the list "just in case". Another laptop is a new examination. The records can prepare the question. They do not authorise the look. Ana's agreement comes first, as it did when the email history was added. The stick's lock and the scope page's lock are the same habit: the record and the authority travel together, and the suspicious file travels with neither. | On the stick | Off the stick | |---|---| | Notes | The installer | | Three hash results | The client list | | The two NEW names in the comparison | Authority to open another laptop | ### 19.2 Worked example | Offered action | Authority and contents | Decision | |---|---|---| | "Stick has notes, three hash results, the comparison, the case date, and sits with the scope page." | The record | Keep | | "Use the two names as what to look for, after Ana agrees." | Preparation, then permission | Keep | | "Copy the installer so the next laptop can be compared byte for byte at home." | Moves the file | Refuse | | "Open the other laptop because the stick already exists." | Skips the ask | Refuse | > **Synthetic case.** The stick is the food bank's copy of Priya's record. ### Errors and limits Do not treat a labelled stick as permission to open the next machine. ### Apply - **EX065 — Stick contents.** What is on the USB stick, what is locked with it, and what must stay off? *Rubric:* 3 = notes, three hash results, and the startup comparison; labelled with the case date; locked with the scope page; the installer and the client list stay off; another laptop still needs Ana's agreement;; 2 = the record is on the stick and the installer is not;; 1 = one item;; 0 = none. ### Continue studying — lesson 19 (chapter 19 of 20) [← Chapter 18](#ch-18) · [Course chapter index](../SUBJECTS.md) · [Chapter 20 →](#ch-20) Continue to the next authored lesson. ## Worked answers **EX065.** The stick holds notes, three hash results, and the startup comparison. It is labelled with the case date and locked with the scope page. The installer and the client list stay off. Another laptop still needs Ana's agreement.