SLAMorris Final Thesis After Corrections.pdf - Cranfield University

only information which does not conflict with existing information in the event
timeline should be added:
1. If a subrecord exists whose name corresponds to an MD5 hash of the
source files current URI, it should be extracted and added to the event
timeline. Section 5.9.3 describes the relationships which can be formed
between the thumbnail cache and user files based on MD5 hashes.
2. Any thumbnail records, with a hash value for the IDAT chunks that
matches the hash value for the original source files thumbnail created
should be extracted. Section 5.9.2 describes the limitations of matching
visual data from the thumbnail cache with user created files.
3. Any records which contain a URI which ends with the same file name
may then be extracted; the same file name may suggest a previous path
of the file or that the file has been copied.
4. Any subrecords which have the same metadata information within them
as the metadata contained within a generated subrecord of the original
source file can then be added. Section 5.9.1discusses the limitations of
forming relationships between thumbnail cache artefacts and user files
based on metadata.
5. Any subrecords of the same file type may then be extracted for hand
analysis by an analyst.
The ability to construct an event timeline based on a single subrecord can assist
in establishing the user’s behaviour; establishing how the file was manipulated
by the user can show their intention and assist with proving or disproving the
mens rea aspect of the investigation [Chapter 4].
Page 95