SLAMorris Final Thesis After Corrections.pdf - Cranfield University

information relating to the files on the USB stick; no information relating to the
thumbnail cache could be found on the external media. The volume name for
the external media is recorded in any subrecords relating to files stored on it;
this volume name can also be found on the virtual hard drive both in allocated
and unallocated space, showing that it has been mounted on the system. The
information found in allocated space shows where the volume was mounted
and can provide information about files present on the disk.
As the subrecords are stored in standard files, their file names are present in
directory listings for the thumbnail cache sub directories. There is also
information on the original source files in the directory listing and within the
journal file which can provide corroboration and extra information about user
activity.
5.8 Alteration of thumbnail cache artefacts
This section describes the experiments performed to ascertain what would
happen if parts of the thumbnail cache evidence were tampered with. The
evidence has been divided into three sections: metadata, the visual thumbnail,
and the original source file. Each section of the evidence was altered by viewing
the virtual hard disk in a hexadecimal editor and editing the information as
appropriate.
5.8.1 Metadata
Each tEXt chunk within the subrecords was altered during a series of
experiments to determine the effect on the artefacts produced. Once the
metadata had been altered, the original source files were then viewed in the file
browser to see if the subrecord was altered. In both Ubuntu and Kubuntu
altering the last modification time chunk without altering the original source file
results in the affected subrecord being updated when the source file is viewed
Page 90