SLAMorris Final Thesis After Corrections.pdf - Cranfield University

the cache to remove inactive records when it reaches its maximum size. The
cache has been shown to create a sub-directory within the explorer directory
named ThumbCacheToDelete; this directory is where outdated versions of
thumbnail cache files are placed prior to deletion. Moving the thumbnail cache
files allows the system to regenerate new files; this is particularly used when the
index requires extra space. During this research no method tested has led to
the secure deletion of thumbnail cache files, therefore once deleted the files are
available in unallocated space.
6.5.4 Fragmentation of the thumbnail cache
The allocation of a predetermined amount of space each time the thumbnail
cache files appears to minimise fragmentation, by ensuring a collection of
records are stored together. However the individual files tend to be fragmented
in clusters the size of the file space allocation unit. Therefore as the files are
unlikely to be contiguous, the grouping of several records or subrecords is likely
to assist with identification.
6.6 Identifying traces left outside the thumbnail cache
This section identifies the artefacts present on a Windows 7 system outside the
thumbnail cache. The thumbnail cache works in conjunction with the rest of the
operating system, and also interacts with user files. Therefore it is necessary to
identify any correlation between artefacts within the thumbnail cache and those
left on the remainder of the system.
The experiments were designed to mimic typical user behaviour to identify
information which changed on the remainder on the system that could be
related to changes within the thumbnail cache. During the experiments potential
thumbnail cache source files were added, modified and deleted both on the
Page
134