SLAMorris Final Thesis After Corrections.pdf - Cranfield University

elationship between information contained within the thumbnail cache and
other evidence present on the system. The use of audio and visual thumbnails
in Windows 7 is discussed in Section 6.9; this is followed by a discussion of the
strengths of the thumbnail cache artefacts identified during this research
[Section 6.10]. Finally the conclusion of this Chapter is presented in Section
6.11.
6.2 Methodology
In order to evaluate the structure and behaviour of the thumbnail caches used in
Windows 7 it is necessary to establish the methodology which will be
implemented during this research. This section describes the general
methodology used throughout this chapter; specific experimental methodology
is described as appropriate throughout the chapter.
A critical review of existing resources relating to Windows operating system
thumbnail caches was conducted in Chapter 2.4; this review enables any
methodology created for this research to take into account existing knowledge
on the subject. The related reading in Chapter 2 identified that originally visual
thumbnails were stored in an alternate data stream for the user generated
source file. In Windows XP, the directory specific thumbnail cache thumbs.db
was introduced which stored visual thumbnails and associated metadata in the
OLE2 format. Windows Vista introduced a user specific centralised thumbnail
cache as its primary method of storing thumbnail information; the structures of
the binary files in the centralised cache were altered again with the introduction
of Windows 7. Limited information is available in the public domain about the
structure or behaviour of the Windows 7 thumbnail cache.
To establish the structure and behaviour of the Windows 7 thumbnail cache it is
necessary to perform a variety of experiments; the experiments establish the
Page
106