SLAMorris Final Thesis After Corrections.pdf - Cranfield University

4.2.4 Procedural Constraints ..................................................................... 53
4.2.5 Human Behavioural Constraints ....................................................... 55
4.3 Criteria for evaluating the evidential value of thumbnail cache
artefacts ........................................................................................................ 58
4.3.1 Provenance of Artefacts ................................................................... 58
4.3.2 Interpretation of Results ................................................................... 59
4.4 Process Criteria ...................................................................................... 60
4.4.1 Provenance of Artefacts ................................................................... 60
4.4.2 Legal and ethical constraints ............................................................ 61
4.5 Conclusion .............................................................................................. 61
5 The Structure and Behaviour of the Operating System Thumbnail Cache
Implementations used in Ubuntu and Kubuntu ................................................. 63
5.1 Introduction ............................................................................................. 63
5.2 Methodology ........................................................................................... 64
5.3 Thumbnail caches ................................................................................... 65
5.4 Default Installations................................................................................. 67
5.5 Identifying the structure ........................................................................... 68
5.5.1 The thumbnail cache directory structure .......................................... 68
5.5.2 The structure of a thumbnail Cache subrecord ................................ 72
5.6 Identifying the behaviour ......................................................................... 80
5.6.1 The creation of subrecords ............................................................... 80
5.6.2 The modification of subrecords ........................................................ 87
5.6.3 Fragmentation of the thumbnail cache ............................................. 89
5.7 Identifying traces left outside the thumbnail cache ................................. 89
5.8 Alteration of thumbnail cache artefacts ................................................... 90
5.8.1 Metadata .......................................................................................... 90
5.8.2 Visual thumbnail ............................................................................... 91
5.8.3 Original source file ........................................................................... 92
5.9 Forming a relationship between the thumbnail subrecords and the
source files .................................................................................................... 92
5.9.1 Metadata .......................................................................................... 93
5.9.2 Images ............................................................................................. 93
5.9.3 MD5 hashes ..................................................................................... 94
5.9.4 Event timeline ................................................................................... 94
5.10 Audio and Media thumbnails ................................................................. 96
5.10.1 Audio thumbnails ............................................................................ 96
5.10.2 Media thumbnails ........................................................................... 96
5.11 Discussion ............................................................................................ 97
5.11.1 Provenance of artefacts ................................................................. 97
5.11.2 Interpretation of results ................................................................. 100
5.12 Conclusion .......................................................................................... 102
vi