SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Subrecord header:
4 bytes – Subrecord signature
4 bytes – Complete size of subrecord in bytes
8 bytes – Thumbnail cache ID
4 bytes – Size of Identifier value in Unicode, during
experimentation only a value of 32 bytes was recorded for visual
thumbnail subrecords.
4 bytes – Size of padding after identifier value
4 bytes – Size of the data section of the subrecord
4 bytes – Unknown but during experiments always 00 00 00 00
8 bytes – Data checksum (CRC 64 value)
8 bytes – Header checksum (CRC 64 value)
Identifier value size Figure (generally 6-4: Subrecord 32 bytes) header – Identifier in Unicode
Padding value size (generally 0) – Padding if required for the
identifier value
The Windows 7 subrecord header is 32 bytes, which is 8 bytes smaller than
theWindows Vista implementation; this is due to the removal of 8 bytes
representing the file extension in Unicode. The Windows Vista structure was
determined during the preliminary experiments performed before this research
using the same methodology described in this Chapter for the identification of
the Windows 7 thumbnail cache structure. The checksum values provide a
method of authenticating the values in the subrecord. Below is an annotated
example subrecord which was created during this research.
Page
117