SLAMorris Final Thesis After Corrections.pdf - Cranfield University

information in the .thumbnails cache either. Visual thumbnails for each of the
media thumbnails were found in the central thumbnail cache; it is possible to
have a visual and a media thumbnail for the same source file. The visual
thumbnail represents the first frame of the media file.
5.11 Discussion
In summary, table 5.1 provides an overview of the main user activity which
leads to artefacts being generated within the thumbnail cache, based on a
default installation. As can be seen from the table, the reasons for subrecords
existing in the two operating systems can be different. Kubuntu, in general
provides a greater amount of evidence within the thumbnail cache, as it uses
the large directory more frequently, which provide larger clearer images of files,
which may assist an analyst. It is also evidentially significant that Kubuntu
generally has both a normal and large subrecord for a file viewed in the file
browser, which may provide further information about the state of the system.
Ubuntu, uses the normal directory for the majority of its subrecord storage, and
is easier to tamper with; suggesting that artefacts recovered from a thumbnail
cache on this operating system would require a greater amount of corroboration
from artefacts elsewhere on the system.
In Chapter 4, a set of criteria were established to assist in assessing the
strength of evidence from a thumbnail cache. These criteria will now be used on
the artefacts found on Kubuntu and Ubuntu during the course of this research to
establish the strength of evidence recovered.
5.11.1 Provenance of artefacts
This chapter has identified the structure and represented behaviour of the
thumbnail cache artefacts in Ubuntu and Kubuntu. An analyst could use the
experimental methods described throughout this chapter (for example Sections
Page 97