The hash print is dict order | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 05. Map, example, EX051.

flowchart TD
  D["Three pairs, insertion order"] --> P["One pass, no sort"]
  P --> O["budget, then the installer, then photo"]
  O --> Q{"Did the match earn the first line?"}
  Q -->|No| K["Keep the embedded print"]

The loop follows the dict. A match does not jump the queue.

Logical drawing

budget.xlsx               0edf30e2fa30  no match
FreeTemplates_setup.exe   3e5d3b83407c  Fake-template adware (synthetic)
photo.jpg                 ffcab6e8630a  no match

Learning outcomes

After this chapter, you should be able to:

Name the order files yields.
Separate that order from a match-first ranking.
Refuse a note that prints the installer row on top.

5.1 One pass, and width 25 is not a ranking.

lab_hashcheck.py stores three pairs in a dict. The first pair is the name budget.xlsx with the byte string for a synthetic spreadsheet. The second pair is FreeTemplates_setup.exe with the installer bytes. The third pair is photo.jpg with the photo bytes. Since Python 3.7 a dict keeps insertion order, and files.items() walks that order. The loop body hashes the current bytes, slices a prefix, and prints. Nothing in the file calls sorted on the names.

The format starts with {name:25}. Width 25 pads a short name with spaces on the right. budget.xlsx is 11 characters, so 14 pad spaces sit inside the field. FreeTemplates_setup.exe is 23 characters, so two pad spaces sit inside the field. photo.jpg is 9 characters, so 16 pad spaces sit inside the field. The format then adds one space before the prefix. Those spaces do not encode risk. The installer row is second because that pair was inserted second, even though a reader might want the only match moved to the top.

A later decision to restore the laptop is a sentence in the report. It does not delete a pair. A print that started with FreeTemplates_setup.exe would be a different dict.

Lesson table; scroll horizontally to read all columns →

What the loop uses	What it does not use
Insertion position in `files`	A match-first sort
The name and the byte string	A startup name
Format width 25	A severity score

5.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered result	What produced it	Decision
Three lines, spreadsheet first	Dict order, one pass	Keep
The installer still second	Its pair was not moved	Keep
"The script sorted matches first."	No sort is called	Refuse
"The no-match lines were dropped."	Two pairs still print `no match`	Refuse

Synthetic case. These three pairs are the only hash output.

Errors and limits

Do not rebuild the dict so that the matching name prints first.

Apply

EX051 — Dict order. The print names budget.xlsx, then FreeTemplates_setup.exe, then photo.jpg. May a match-first ranking, or a later decision to restore the laptop, replace that order?
Show marking criteria
Rubric: 3 = no; the three pairs stay in insertion order; width 25 is padding; do not sort the script;; 2 = the three lines stay and the restore stays prose;; 1 = one line;; 0 = none.