SLAMorris Final Thesis After Corrections.pdf - Cranfield University

and network places. As these items use default icons, only the standard
metadata in the subrecord header is stored in the thumbnail cache. New
subrecords are added when locations are added to the right side panel, either
by the system or a user and are visible in the file browser.
Subrecords relating to locations which are no longer present do not appear to
be removed. This was shown by continuing with the experiment over a 12 week
period where 8 devices were originally on the same network as the virtual
machine; every 4 weeks a device was removed from the network; Windows
Explorer was then viewed to confirm the device was no longer available. At the
end of the experiment the thumbnail cache was analysed and subrecords
relating to all 8 original devices and the virtual machine were found. This may
be a useful source of information for analysts as it can provide a list of drives
which have been allocated and machines which have been networked to the
users machine; it also provides the name of the users machine as this is shown
in the network places list within the panel. Further investigation of drive
allocation and network place subrecords is discussed in Section 6.6.
Figure 6-8: A screenshot from a test to see if records were created for files which
had not been viewed
Page
129