windows3-10  Exercise 2: Rank Your Suspects
=================================================================

Verification: Level 1 (reasoning about measured evidence; nothing run).

Prediction (work this out before running the script):

  Before reading the solution: for each of your suspects, what single observation would most raise or lower it?

This is a reasoning exercise using the evidence in chapters 6 to 9; no commands are needed. Worked example for this PC:

Worked example:

  1. Feature update / a driver it exposed
       For: 87 quiet days, then three restarts within 11 days of the 8 October update.
       Against: correlation; many things changed at once.
       Next test: read the dumps for a named module, then test that driver.
  2. Third-party kernel drivers in the network path (4 VPNs, Killer, 2 security drivers, Citrix)
       For: Microsoft estimates about three quarters of stop errors are faulting drivers.
       Against: no dump has named one.
       Next test: remove unused VPNs one at a time (reinstall the app to undo).
  3. RAM
       For: same heap-corruption code twice.
       Against: no WHEA events; at rated speed; but no memory test done.
       Next test: MemTest86, both sticks then each alone (refit to undo).
  Evidence that would change the ranking most: the dumps. If they name one module in both crashes, suspect 1 or 2 becomes
  specific; if they name different modules, memory or hardware rises.

WHY THIS WORKS AS AN ANSWER
---------------------------
  The ranking uses three things: how much evidence supports a suspect, how much contradicts it, and how cheap and
  reversible the next test is. Cheap, reversible tests go first even for a less likely suspect. The answer to the last
  part must be a specific missing piece of evidence, not 'more data'.
  Common mistakes: ranking by gut feeling about which part is most likely to fail; not stating the evidence against;
  proposing a test that cannot be undone; and treating the correlation with the update as a cause.