SLAMorris Final Thesis After Corrections.pdf - Cranfield University

ascertain if unused subrecords would be removed. In both experiments the
thumbnail cache was not altered; this shows that information in the thumbnail
cache may relate to source files which are no longer on the system.
5.6.3 Fragmentation of the thumbnail cache
The data produced during the experiments documented in Sections 5.5 and
5.6 was analysed to ascertain the fragmentation rate of the thumbnail caches
within Kubuntu and Ubuntu. It was noted that the thumbnail cache is generally
in a fragmented state; as each individual file which makes up part of the
thumbnail cache is stored in a different location on the disk. This is due to the
fact it is made up of individual subrecord files, each of which being a standard
file on the system can be placed anywhere. Therefore upon examination
thumbnail cache subrecords exist throughout the system. This is interesting for
an analyst as it provides a greater chance of recovering some information from
the thumbnail cache, as even after deletion the files exist throughout the system
and it is therefore unlikely they would all be overwritten unless the user was
purposefully trying to do so.
5.7 Identifying traces left outside the thumbnail cache
This section describes the corroborating artefacts identified on the rest of the
system during the experiments performed to ascertain the structure and
behaviour of the thumbnail cache.
A variety of the experiments described in previous sections involved the use of
external media, however no information relating to the thumbnail cache could
be found on the external media after use. A further experiment was performed
where a USB stick containing 500 images was left plugged into the virtual
machine for 7 days, with the file browser open. The resulting hard disk and USB
stick were analysed, the thumbnail cache on the hard disk contained
Page 89