SLAMorris Final Thesis After Corrections.pdf - Cranfield University

The structures were reverse engineered based upon previous experiments in
Windows Vista and the experiments documented above. The two experimental
sets permitted the structure of the thumbnail cache to be reverse engineered;
this provided the information documented in the following sub-sections. An
analysis of the data collected was performed using a hex editor, and by
comparing the different thumbnail caches based upon the actions that were
taken it was possible to deduce the associated structure. Partial thumbnail
cache structures have been presented on some websites [Noxa, 2008;
Parsonage, 2012]. In contrast with prior works the present research adopts a
systematic methodology including experiment planning and quantitative
analysis of efficiency and effectiveness of the existing approaches to thumbnail
fragment detection and reassembly. Any structural and syntactical information
identified during this research will be added to the thumbnail cache extraction
program to enable artefacts to be automatically extracted from Windows 7
thumbnail caches.
This section begins with an overview of the thumbnail cache directory structure;
this is followed by an overview of the structures contained within the six files
used in the thumbnail cache.
6.4.2 The thumbnail cache directory structure
In section 6.3the operating system thumbnail cache implemented in Windows 7
was found to reside in a user’s home directory. Windows 7 has a centralised
thumbnail cache for each user rather than the directory specific cache system
used in Windows XP. This directory was shown to contain six thumbnail cache
files: an index and five further files. The index holds records, which provide
pointers to the location of subrecords in the remaining files; the structure of the
thumbnail cache is shown in Figure 6.2.
Page
113