SLAMorris Final Thesis After Corrections.pdf - Cranfield University

6 The structure and behaviour of the Windows 7
Operating System Thumbnail Cache
6.1 Introduction
The release of Windows Vista prompted speculation from Forensic analysts
about the impact of the new Operating system on investigations [Hargreaves,
2008]. One interesting change was the move away from the directory specific
thumbs.db, to each user having a single centralised thumbnail cache. The
release of Windows 7 in 2009 prompted further speculation from analysts;
additional changes were introduced to the structure and behaviour of system
components such as Windows Desktop Search [Chivers, 2011].The centralised
thumbnail cache format introduced in Windows Vista had also been adapted in
the new operating system.
Microsoft operating systems are installed on a significant proportion of user
machines and it is therefore unsurprising that currently a significant proportion
of forensic analysis involves their operating systems. Due to the likelihood of
encountering a Windows based operating system there is significant interest in
finding and understanding relevant artefacts within the forensic community.
This Chapter identifies the structure and behaviour of the Windows 7 operating
system thumbnail caches; it begins with the methodology employed within this
chapter [Section 6.2]. This is followed by the identification of relevant artefacts
in a baseline installation of Windows 7 [Section 6.3]. Section 6.4 identifies the
structure of the thumbnail cache components. In Section 6.5 the behaviour of
the thumbnail cache is identified through experimentation, this is followed by a
review of artefacts related to the thumbnail cache which are present on the
operating system [Section 6.6]. Section 6.7 looks at the effect of tampering
with data contained within the thumbnail cache; Section 6.8 looks at forming a
Page
105