SLAMorris Final Thesis After Corrections.pdf - Cranfield University

5.9.3 MD5 hashes
In the previous sections it was established that the filename of a visual
thumbnail is an MD5 hash of the URI for the original file. The URI is contained
within the PNG file itself. For example an original file with a URI of:
file:///media/KINGSTON/untitled.bmp would create an MD5 hash filename of
5421fffe972f1173d0223624143dfb11.png. Whilst it is possible to find a
subrecord given the URI of a source file, it is not possible to reverse this
process as an MD5 hash is a one way function.
5.9.4 Event timeline
Given a file X, Currently located at the URI Y, the thumbnail cache can assist
with reconstructing the event timeline of file X; providing sub-records exist within
the thumbnail cache relating to the file. This section describes the criteria
developed for determining which subrecords should be added to an eventtimeline
for a given file.
First, if available the original source file and the associated metadata must be
extracted, this forms the basis for determining which records should be added
to the event timeline for a file. A thumbnail of the file should then be generated
using the appropriate algorithm for the source files type; this can be determined
by looking through the source code and establishing which algorithm is
associated with the particular MIME type.
The following denotes the order in which subrecords should be added to the
event timeline. Each subrecord is contained within a PNG file which has file
creation and modification times; subrecords may also contain time information
within their internal metadata. The order of adding subrecords ensures that the
strongest evidence is added first; this is followed by any supplementary
evidence which does not conflict with existing data. At each level listed below,
Page 94