SLAMorris Final Thesis After Corrections.pdf - Cranfield University

consequences of the method used. For example the research conducted into
the reasons subrecords are created in Section 5.6.1 was broken down into
smaller research areas; focused experiments, such as the use of different
methods for adding files which is described in Section 5.6.1.1, assist in
maintaining a relationship between the original data and the artefact. The
artefacts identified as a consequence of the user behaviour were documented
throughout this chapter and could be applied to artefacts identified during
forensic investigations.
Any artefact presented in Court must be shown to have been extracted and
interpreted using a scientific method. Each artefact identified from the Ubuntu
and Kubuntu thumbnail caches can be checked to ensure it has a valid
structure and syntax; sub-records use the standard PNG file format. Section 5.8
shows methods in which the thumbnail cache could be tampered with; however
the remainder of the system would also require editing to ensure that all
relationships between artefacts on the system remained valid. The artefact can
provide a set of data which may also assist with identifying or disproving a type
of associated behaviour. The ability to corroborate the artefacts with other
system data can provide further validation of the interpretation of the data which
is presented to the Court.
5.11.2 Interpretation of results
Thumbnail cache artefacts can provide information on potential user activity; in
order to put the artefact in the context it is necessary to establish the potential
system activity which led to its current state. Therefore the analyst may need to
defend that the artefact is a result of the system working properly. Some of the
thumbnail cache artefacts identified show the creation algorithm which can
assist with verifying the artefact and related system artefacts. This research has
investigated the manipulation of the thumbnail cache artefacts [Section 5.8]; it
has shown that parts of the thumbnail cache can be manipulated. However for
Page
100