SLAMorris Final Thesis After Corrections.pdf - Cranfield University

highlighting the need for understanding the context of any artefacts recovered
from a system. This chapter has shown some opportunities for maximising the
recovery of evidence but it has not addressed the potential recovery of artefacts
from unallocated space; the identification of thumbnail cache data in
unallocated space is discussed further in Chapters 7-9. The remaining criteria
can be met by artefacts from the Ubuntu and Kubuntu thumbnail caches; the
scientific based method used to extract thumbnail cache artefacts and related
system data provides a wide range of information about system behaviour.
Page
103