SLAMorris Final Thesis After Corrections.pdf - Cranfield University

In Ubuntu and Kubuntu the thumbnail cache is stored in a centralised directory
for each user; therefore in order to maximise the data recovered from the live
thumbnail cache it is necessary to extract and examine the thumbnail cache
directory. The carving of data relating to these thumbnail caches from
unallocated space is discussed in Chapters 7-9.
The structure and syntax identified in Section 5.5 permit the automation of
extracting the data and the identification and reassembly of potential file
fragments from unallocated space; a tool could be created based upon the
identified structure and syntax for file carving.
5.12 Conclusion
This research has shown the structural implementations of the operating system
thumbnail caches used by Ubuntu and Kubuntu. Whilst both thumbnail caches
have multiple sources of corroborating artefacts their thumbnail cache and the
subrecords contained within them, this research has highlighted the significant
differences in context between artefacts recovered from the operating systems.
Contextual analysis of an artefact can show the user activity which may have
led to the artefact being on the system; it has been shown that the availability of
corroborating artefacts can have a significant impact on the strength of the
evidence. It has also been shown that the Ubuntu thumbnail cache performs
less stringent checks on the subrecords to determine if they require updating
and therefore it is easy to tamper with the subrecords and mislead a user or an
analyst. Audio and media thumbnails do not use the thumbnail cache, however
it was determined that a media thumbnail may also have a visual thumbnail.
Finally after an analysis of the research conducted it was determined that given
a live cache, Kubuntu can produce stronger evidence from the thumbnail cache;
Page
102