SLAMorris Final Thesis After Corrections.pdf - Cranfield University

order to establish if the software used to view the files affects the thumbnail
cache, various methods of viewing files were also tried. This sub-section ends
with a summary of the user activity which leads to information being added to
the thumbnail cache
Using different methods for adding files
Using each of the four methods described above, a set of 10 user generated
files were added to the system; the files were: copied from a USB stick, copied
from a CD, downloaded from an email, and created using pre-installed software.
For each experiment the user generated files were saved to the user’s
documents folder and then viewed using the file manager to view the visual
thumbnails for each file.
In both Ubuntu and Kubuntu, files from the USB stick and the CD had two sets
of entries in the thumbnail cache, as the images were cached when the files
were browsed on the external and operating system volumes. The thumbnail
cache subrecords relating to the files on the volumes contained the volume
name as part of the URI. This may assist an examiner as it can provide extra
information about the external media; the additional subrecords may also assist
in creating an event timeline. Files downloaded from email, or created by preinstalled
software only appeared in each thumbnail cache sub-directory once.
A follow-up experiment was performed for the addition of files using external
media, with five hundred user files; the user files were stored in various
directories and sub-directories created within the user’s documents folder. It
was noted that using the file browser to view the files for different lengths of
time produced different results; the number of subrecords created in the cache
appeared to be dependent on the length of time the directory was viewed in the
file browser. This is due to the system putting files into a queue for visual
Page 81