Teach the distinction.

Before the session

Allow about five minutes to extract and inspect the kit. Use the worksheet separately from this key. The ZIP’s HTML pages share a local stylesheet, so keep them together. Offline handouts work after extraction; the two hosted tools require a connection. No app software is bundled.

Ask learners not to edit the fixtures. If an editor resaves them, extract fresh copies instead of treating unexpected hashes as tool failure. If the file picker cannot select multiple files, demonstrate the collection exercise on a supported desktop browser. Do not infer that a blocked download or picker is permission to change device security settings.

Timing and prompts

• 0–5: Collect predictions before showing hashes. Ask whether “backup” tells us anything about contents.
• 5–13: Compare original/copy first, then the same-size character change. Ask why size alone was insufficient. Explain LF as byte 0A and CRLF as bytes 0D 0A.
• 13–22: Keep all copies before making any review decisions. Ask why two empty files are duplicates but offer zero bytes of potential savings.
• 22–27: Compare the altered file against its own newly calculated hash. Ask who established the trusted baseline.
• 27–30: Use the exit questions to check understanding; no certification or pass claim is attached.

Exact reference values

All text is UTF-8 without a byte-order mark. Files 01–03 contain Workshop sample: blue folder. followed by LF. File 04 changes lowercase b to uppercase B. File 05 uses CRLF; file 06 has no final newline. Files 07–08 are truly empty.

Download the machine-readable reference manifest. These hashes are teaching references for this kit, not independent proof that this publisher or download is trustworthy.

Expected tool results

• Against file 01’s full checksum, files 02 and 03 match; files 04, 05, 06, 07 and 08 do not.
• File 04 has the same 30-byte size as the original, but a different hash. File 05 has 31 bytes; file 06 has 29.
• Files 07 and 08 produce the standard empty-input SHA-256 shown above. An empty file still has a digest.
• TwinTrail finds two groups: files 01/02/03 and files 07/08. The other three files remain unique in this collection.
• “Keep every copy” gives 0 copies marked for review and 0 potential bytes.
• Keeping 01 and 07 while marking 02, 03 and 08 for review gives 3 copies marked for review and 60 potential bytes. The empty copy contributes zero bytes. This is a logical-byte estimate, not actual disk-space recovery.
• The exported checklist records choices. No file is deleted or changed. Duplicate membership and selected keep files matter; group ordering and initial automatic keeper choice need not be memorized.
• File 04 compared against its own correct hash matches. This establishes agreement with that reference, not that the file is the intended original.

Exit answers and useful misconceptions

1. Yes. Names are not the bytes being hashed. Files 01–03 illustrate this.
2. Yes. The original and the one-character change are both 30 bytes.
3. Invisible bytes count. LF, CRLF and the presence of a final newline change the input. A hash mismatch does not identify the changed position.
4. Origin, authorization, safety and intent remain unproved. Check a reference’s provenance separately. These tools do not verify digital signatures or scan for malware.
5. Zero deleted files. Copies can be intentional backups, required records or needed in separate workflows. An identical byte sequence is evidence for a review, not a deletion instruction.

Credit explanations that separate byte equality from naming, trust and purpose. If someone says “hashes can never collide,” clarify that SHA-256 collision resistance is computational rather than an absolute uniqueness guarantee. Keep byte confirmation enabled for this exercise.

Troubleshooting and limits

• Unexpected original hash: use fresh extracted files, Local file mode and SHA-256. Do not copy visible text from the handout as a substitute.
• Wrong duplicate count: select only the eight fixtures once. Repeated selections or including exported reports changes the collection.
• Missing relative paths: ordinary file selection may show names only; the exercise uses unique filenames and does not require folders.
• A tab reload clears TwinTrail’s in-memory decisions. Export first if you want to keep the fictional review record.
• Shortened expected hashes are not valid comparisons. Use the full 64 hexadecimal characters.

Consult the workshop references for background. This is a short teaching exercise, not a preservation policy, security audit or forensic procedure.