The Full Run

Doing the whole thing

You have worked every category separately. Now do them in one sitting, against a clean machine, with a clock.

Reset to clean

Re-import the .ova to get a fresh machine sitting at 0 out of 100. Delete the old one from VirtualBox first so you do not end up with two copies.

Give yourself a fixed block of time. Two hours is realistic.

The order

 0. start from a clean machine
 1. read the ReadMe, write down both account lists
 2. do whatever the ReadMe explicitly asks for
 3. forensics: answer all three and write the file
 4. accounts: Settings > Users, then /etc/passwd
 5. services: what is listening, what starts on its own
 6. software: what is installed that should not be
 7. files: scheduled jobs, startup files, permissions, borrowed power
 8. system settings, /tmp, automatic updates
 9. restart
10. re-read the report and compare

The two habits that matter

Neither is about typing faster:

1. Write down every change as you make it. When a penalty appears you want to undo one thing, not guess at five.
2. Finish a category before starting the next. Half-checking three areas is how you finish with points left in all three.

💡 Nobody runs out of time. They run out of ideas. When you feel finished you are usually at about 80 percent. Go back to the worklist and do the sections you skimmed. The last fifteen points are always somewhere you did not look.

What finished looks like

After the run

For every point you did not get, the useful question is not "what was the answer" but "which check would have found it?" That is what turns one image into a method that works on the next one.

Try it yourself

Start from a clean machine and run it end to end, working from the worklist. Restart before you call it done.