SLAMorris Final Thesis After Corrections.pdf - Cranfield University

5.2, and 5.5) to replicate the experiments and verify the artefacts presented.
The ability to replicate the results based on the descriptions provided in the
chapter show the use of clear documentation; an analyst would be familiar
with this style of documentation. A research paper on this work using the same
style of documentation was available to analysts [Morris 2010] and was used in
a lecture on thumbnail caches delivered at the Centre for Forensic Computing,
Cranfield University in January 2012.
In Section 5.5 the structures found in thumbnail cache artefacts are identified,
this led to the experiments in Section 5.6 which enabled relationships to be
formed between the artefacts and the behaviour which led to their current state.
In order to corroborate the information retrieved from the thumbnail cache it was
necessary to form relationships with other system artefacts which are in
Section 5.7.The thumbnail cache artefacts identified during this research are
justifiable as they are identified using a standard replicable process that
enables the verification of the artefacts presented.
The features identified in the thumbnail cache motivate the requirement to
identify and provide corroboration. For example, if an analyst was investigating
claims a suspect had being viewing illegal material and used a file browser, the
thumbnail cache would contain a small graphic representation of a source file,
and a location it had resided in [Section 5.5].It would also provide information
about user behaviour which may or may not have led to the creation of the
artefacts in the thumbnail cache. In order to identify the user behaviour
associated with the artefacts and verify the information stored in the thumbnail
cache it is necessary to form corroborative relationships with other artefacts on
the system [Section 5.6]. Therefore for an analyst to put the information
recovered from the thumbnail cache into context he would need to corroborate
the information; this could be achieved by identifying other sources of
information about the source file on the system. Whilst Ubuntu relies upon the
last modification time for deciding whether to regenerate an image, Kubuntu
Page 98