The script hashes the bytes it was given | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 08. Map, example, EX054.

flowchart TD
  B["Three byte strings in the file"] --> S["sha256 of those bytes"]
  S --> C{"Same bytes as the one key's input?"}
  C -->|Installer only| H["Label"]
  C -->|The other two| M["no match"]
  H --> R["No path was opened"]

The filename is printed. The bytes are hashed.

Logical drawing

hashed
  b"synthetic spreadsheet bytes"
  b"synthetic installer bytes - not a real program"
  b"synthetic photo bytes"
not done
  open a path
  start the installer
  upload the bytes
equal inputs
  the installer string and the known_bad input

Learning outcomes

After this chapter, you should be able to:

Name the three byte strings.
Explain why only one of them hits.
Refuse a claim that the script opened FB-LAP-02.

8.1 Equality is on the bytes. The name is only a label.

The installer pair and the known_bad entry are built from the same byte string, b"synthetic installer bytes - not a real program". SHA-256 of the same input returns the same digest, so the lookup hits. The spreadsheet string and the photo string are different inputs, so their digests miss. The filename is display text beside the row. Renaming the installer leaves the hit in place, because those bytes are unchanged. Putting the photo bytes under that same display name misses, because the SHA-256 input changed.

The file contains no open call and no process start. It does not read a directory on FB-LAP-02, and it does not launch the named installer. That is the point of the exercise: identification without running anything. RFC 3227's collection guidance is about not disturbing what you still need to study. Running a program to "see" it would change the laptop. This script never receives that chance, because its inputs are literals.

Ana has not agreed to a public upload, and the chapter does not add one. The bytes might stand in for a file that held private data. The lab's strings are synthetic on purpose, and they still are not pasted to a website from this lesson.

Lesson table; scroll horizontally to read all columns →

Input	What the hash sees
Installer literal	The same bytes as the one key
Spreadsheet literal	A different byte string
Photo literal	A different byte string
The filename	Displayed, not hashed

8.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered claim	What the source shows	Decision
The hit follows from equal byte strings	Same literal in both places	Keep
The other two literals differ	Their digests miss	Keep
"The script opened Downloads."	No `open` call	Refuse
"The `.exe` suffix caused the hit."	The suffix is not hashed	Refuse

Synthetic case. The three strings are not files from a food-bank disk.

Errors and limits

Do not add a path, a launch, or an upload in order to make the lab feel more real.

Apply

EX054 — What was hashed. Why does FreeTemplates_setup.exe hit while the other two names miss, and did the script open the laptop?
Show marking criteria
Rubric: 3 = the installer literal equals the known-bad input; the other literals differ; the filename is not hashed; no path is opened and nothing is started;; 2 = equal bytes explain the hit and the laptop is not opened;; 1 = the name only;; 0 = none.