OpenCyber AcademyLesson map
Lesson 19. Map, example, EX065.
flowchart TD
N["Notes"] --> U["Labelled stick"]
H["Three hash results"] --> U
C["Startup comparison"] --> U
U --> L["Locked with the scope page"]
I["Installer"] --> X["Not on the stick"]
CL["Client list"] --> X
The stick preserves the examination. It does not preserve the program.
Logical drawing
on the stick
notes
three hash results
comparison showing TemplateUpdater and AlertPopup
label
the case date
kept with
the scope page
absent
FreeTemplates_setup.exe
the client list
Learning outcomes
After this chapter, you should be able to:
- List the three classes of record on the stick.
- Name what was left off.
- Refuse an examination of another laptop that Ana has not approved.
19.1 The stick is a copy of the record. Another laptop still needs a new ask.
Priya labels the USB stick with the case date and keeps it locked with the scope page. The contents are her notes, the three hash results, and the startup comparison that shows TemplateUpdater and AlertPopup. If the same adware shows up on another food-bank laptop, those records say what to look for: the prefix behaviour of a known installer name, and the two startup names. They are not a copy of the program. The installer stays off the stick.
The client list stays off for a prior reason. She never opened it, so she has nothing from it to copy. "Nothing pointed to data leaving" is the case's observation. If a later case did show data leaving, Ana would decide whether clients must be told. This stick does not smuggle that decision forward by holding the list "just in case".
Another laptop is a new examination. The records can prepare the question. They do not authorise the look. Ana's agreement comes first, as it did when the email history was added. The stick's lock and the scope page's lock are the same habit: the record and the authority travel together, and the suspicious file travels with neither.
Lesson table; scroll horizontally to read all columns →
| On the stick | Off the stick |
|---|---|
| Notes | The installer |
| Three hash results | The client list |
| The two NEW names in the comparison | Authority to open another laptop |
19.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered action | Authority and contents | Decision |
|---|---|---|
| "Stick has notes, three hash results, the comparison, the case date, and sits with the scope page." | The record | Keep |
| "Use the two names as what to look for, after Ana agrees." | Preparation, then permission | Keep |
| "Copy the installer so the next laptop can be compared byte for byte at home." | Moves the file | Refuse |
| "Open the other laptop because the stick already exists." | Skips the ask | Refuse |
Synthetic case. The stick is the food bank's copy of Priya's record.
Errors and limits
Do not treat a labelled stick as permission to open the next machine.
Apply
- EX065 — Stick contents. What is on the USB stick, what is locked with it, and what must stay off?
Show marking criteria
Rubric: 3 = notes, three hash results, and the startup comparison; labelled with the case date; locked with the scope page; the installer and the client list stay off; another laptop still needs Ana's agreement;; 2 = the record is on the stick and the installer is not;; 1 = one item;; 0 = none.