Class notes · TryHackMe Pre Security (2026 path) · Module 2

Quick reference: the short version of this module is the Module 2 cheat sheet. Hands-on hardware detail is in TCM Help Desk sections 4–5.

Note: rooms in this module include Inside a Computer System and Computer Types. These notes are written from the module outline — cross-check room specifics as you go.

Learning objectives

By the end of these notes you should be able to:

Explain the input–process–output–storage model of a computer.
Name the main components and explain what each does and how they connect.
Explain why computers have several kinds of memory and storage.
Walk through the boot process from power button to desktop.
Compare the different types of computer and where each is used.
Explain the client–server model.
Describe how the type of device affects its security.

1. What is a computer?

A computer is a machine that takes input, processes it according to instructions, produces output and stores data for later. Everything from a smartwatch to a cloud data centre fits this model.

        \+------------------------------\+

1.1 Worked example — tracing “save a document”

Input: you press Ctrl+S. The keyboard sends a signal, and the OS passes it to the word processor.
Process: the CPU runs the program’s save code, converting the document in RAM into the file format.
Storage: the OS writes the bytes to the SSD through the storage controller.
Output: the screen updates to show “Saved”.

Four parts of the computer cooperated in well under a second.

2. Inside a computer system

2.1 The components

Component

Job

Analogy

CPU (processor)

Executes instructions — calculations, logic, decisions

The brain

RAM (memory)

Holds programs and data in use right now; fast but volatile

Short-term memory / a desk you work on

Storage (SSD / HDD)

Keeps data permanently, even when off

Long-term memory / a filing cabinet

Motherboard

Connects every component and carries data between them

The nervous system

PSU

Converts mains power to what the components need

The heart

GPU

Draws images for the display; also fast parallel maths

The visual system

NIC (network interface)

Connects to networks; has a unique MAC address

Voice and ears

Firmware (BIOS / UEFI)

The first code that runs: tests hardware and starts the OS

Reflexes on waking

Peripherals

Input/output devices: keyboard, mouse, monitor, printer

Hands, eyes, voice

2.2 Why several kinds of memory?

There’s a trade-off between speed, capacity and cost:

Level

Speed

Size

Cost per GB

Keeps data when off?

CPU registers

Fastest

Tiny (bytes)

Highest

CPU cache

Very fast

KB–MB

Very high

RAM

Fast

Moderate

SSD

Slower

Hundreds of GB – TB

Low

Yes

HDD

Slowest

Lowest

Yes

Computers keep the data they need right now in the fastest memory and everything else in larger, slower storage.

Exam tip: RAM is volatile (cleared at power-off); storage is non-volatile. “Memory” and “storage” aren’t the same thing, even though people often mix them up.

2.3 How components connect

Components communicate over buses — shared electrical pathways — and point-to-point links:

        \+-------\+        \+-------\+
        |  CPU  |<======>|  RAM  |   memory bus (fastest link)
        \+---\+---\+        \+-------\+
            |
            | PCIe lanes
  \+---------\+-----------\+-------------\+
  |                     |             |

The chipset — on the motherboard; routes slower devices (USB, SATA, audio) to the CPU.
USB, Thunderbolt, SATA — connect peripherals and drives.

3. The boot process

What happens between pressing the power button and seeing the login screen:

Step

What happens

Where it can fail

Power on

PSU stabilises voltages and signals “power good”

Dead PSU, no power

Firmware starts

The CPU runs BIOS/UEFI code from a chip on the motherboard

Corrupt firmware

POST

Power-on self-test checks CPU, RAM and video

Beep codes or LEDs for bad RAM or GPU

Find boot device

Firmware reads the boot order (SSD, USB, network)

“No bootable device”

Bootloader

Windows Boot Manager or GRUB loads the OS kernel

Corrupt bootloader; Secure Boot rejects it

Kernel

The OS core loads drivers and takes control of the hardware

Blue screen or kernel panic from a bad driver

Services

Background services start (networking, security, updates)

Slow boot from a misbehaving service

You sign in; your user environment loads

Profile problems

3.1 Checking boot information

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime \

when did it last boot?

Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, TotalPhysicalMemory \

BIOS mode (UEFI/Legacy), Secure Boot state

msinfo32 uptime -s \

last boot time

systemd-analyze \

how long the boot took (firmware, loader, kernel, userspace)

systemd-analyze blame \

which services slowed it down

journalctl -b \

logs from this boot

3.2 Worked example — a slow boot

A user says their Linux laptop takes nearly two minutes to boot.

Measure: systemd-analyze shows most of the time in “userspace”.
Find the culprit: systemd-analyze blame shows NetworkManager-wait-online.service taking 90 seconds.
Diagnose: the service waits for a network the laptop isn’t connected to at boot.
Fix: disable that wait service (if nothing depends on it), then reboot and re-measure.

Measure, identify, fix, verify — the same method as the TCM troubleshooting steps.

4. Types of computer

Type

Traits

Typical use

Desktop

Powerful for the price, upgradable, stays in one place

Office work, gaming, engineering

Laptop

Portable, battery-powered, integrated parts

Mobile work, students

Workstation

High-end desktop with ECC RAM and pro GPUs

CAD, video, data science

Server

Runs services for others; always on; redundant PSUs, ECC RAM, often rack-mounted and headless

Websites, email, file storage, databases

Smartphone / tablet

Always connected; touch; sensors; app stores

Personal and work communication

Embedded system

A computer built into another device for one job

Car engine units, washing machines, medical devices

IoT device

A networked embedded device

Smart cameras, thermostats, speakers

Mainframe

Enormous transaction throughput and reliability

Banks, airlines, government

Supercomputer

Massive parallel computation

Weather, science, AI research

Virtual machine

A computer made of software, running on a host

Servers, labs, cloud

Cloud instance

A VM or container rented from a provider

Scalable services

4.1 Clients and servers

A client requests a service: your browser, an email app.
A server provides it: the web server, the mail server.

The same hardware can be either; it’s a role, not a type of machine.

[Your laptop: client] – “GET /index.html” –> [Web server] <—– web page ––––

4.2 Worked example — matching devices to jobs

Need

Best fit

Why

Host the company intranet, 24/7

Server (or cloud instance)

Always on, redundant, managed centrally

A field engineer who travels daily

Laptop (+ smartphone)

Portable, battery, encrypted

Monitor room temperature in a warehouse

IoT sensor

Cheap, low-power, single purpose

Practise hacking safely

Virtual machine

Isolated, snapshot and revert

Render 3D animation

Workstation

Pro GPU, lots of ECC RAM

4.3 Identify a machine from the command line

hostname, OS, kernel, “Chassis” (laptop/desktop/vm), “Virtualization”

hostnamectl systemd-detect-virt \

kvm, vmware, oracle (VirtualBox) — or “none”

lscpu; free -h; lsblk \

CPU, memory, disks

“Virtual Machine” gives Hyper-V away

Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model \

e.g. 3 = desktop, 9/10 = laptop/notebook

(Get-CimInstance Win32_SystemEnclosure).ChassisTypes

5. Security perspective

5.1 Every device type brings its own risks

Device

Key risk

Key control

Laptop

Loss or theft

Full-disk encryption, MDM remote wipe

Desktop

Physical tampering

Firmware password, chassis locks

Server

High-value target running shared services

Patching, hardening, monitoring, segmentation

Smartphone

Mixed personal and work data; malicious apps

MDM, app control, updates

IoT / embedded

Default passwords; rarely patched

Change credentials; isolate on its own network

Relies on the hypervisor for isolation

Patch the host; separate sensitive workloads

5.2 Other security points

The boot chain is a target.
- Bootkits load before the OS, out of reach of antivirus.
- Secure Boot verifies each stage is signed.
- The TPM records what booted, so BitLocker can refuse to unlock if the boot chain changes.
Physical access is powerful. Booting from USB bypasses the installed OS entirely. Firmware passwords, USB-boot disabled and disk encryption close that door.
RAM is volatile evidence.
- Running processes, network connections, encryption keys and “fileless” malware may exist only in memory.
- Incident responders capture memory before powering a machine off.
IoT expands the attack surface quietly. Every smart device on a network is another computer that can be compromised — often the weakest one.

Summary

A computer takes input, processes it, produces output and stores data.
Components: CPU (processing), RAM (volatile working memory), storage (persistent), motherboard (connections), PSU (power), GPU (display), NIC (network), firmware (start-up).
The memory hierarchy trades speed for size and cost: registers → cache → RAM → SSD → HDD.
Boot: power → firmware/POST → boot device → bootloader → kernel → services → login.
Computer types range from embedded chips to mainframes. Client and server are roles, not hardware.
Security depends on device type; protect the boot chain and the physical box; capture RAM before shutdown in an incident.

Glossary

Term

Definition

Input / output

Data entering / leaving a computer

CPU

Central processing unit — executes instructions

RAM

Random access memory — fast, volatile working memory

Volatile

Loses its contents when power is removed

Storage

Non-volatile data retention (SSD, HDD)

Motherboard

The main circuit board connecting all components

Bus

A shared pathway for data between components

PCIe

High-speed interface for GPUs, NVMe drives and cards

Chipset

Motherboard controller linking CPU to slower devices

NIC

Network interface card; holds the MAC address

Firmware

Low-level software stored on a chip (BIOS/UEFI)

POST

Power-on self-test

Bootloader

Program that loads the OS kernel

Kernel

The core of the operating system

Server

A computer (or role) providing services to clients

Embedded system

A computer built into a device for a dedicated function

IoT

Internet of Things — networked everyday devices

Virtual machine

A software-emulated computer running on a host

Secure Boot

Firmware feature that only runs signed bootloaders

TPM

Trusted Platform Module — secure chip storing keys and boot measurements

Review questions

Describe the four parts of the input–process–output–storage model.
Why can’t a computer just use RAM for everything?
Which is faster: CPU cache or RAM? Which holds more?
What does POST check, and what happens if it fails?
What loads the operating system kernel?
A server and a desktop can use similar hardware. What makes a machine a server?
Which device type is most likely to ship with default passwords and never be patched?
How do you check whether a Linux system is a virtual machine?
Why do incident responders capture RAM before shutting a machine down?
What does Secure Boot protect against?
A laptop is stolen. Which two controls most reduce the damage?
Which bus or link connects an NVMe SSD to the CPU?

Answer key

Input (data in), process (the CPU runs instructions), output (results out), storage (data kept for later).
RAM is volatile and expensive per GB. Data would vanish at power-off, and large amounts would cost far too much. Storage is cheap and persistent.
Cache is faster; RAM holds more.
CPU, RAM and video. On failure the firmware signals with beep codes or LEDs and doesn’t boot.
The bootloader (Windows Boot Manager or GRUB).
Its role — it provides services to clients. Servers are usually built for it too: always on, redundant, remotely managed.
IoT and embedded devices.
systemd-detect-virt (or hostnamectl, which shows Virtualization and Chassis).
RAM is volatile, and holds processes, connections, keys and fileless malware that disappear at power-off.
Unsigned or tampered bootloaders, such as bootkits.
Full-disk encryption and MDM remote lock/wipe.
PCIe lanes.