SLAMorris Final Thesis After Corrections.pdf - Cranfield University

which have a relationship with the thumbnail cache record; therefore if
tampering had occurred an analyst would identify conflicting artefacts.
6.7.3 Original source file
In Section 6.5 it was shown that the modification of the contents of a user file
within the virtual machine would result in the corresponding record in the
thumbnail cache being updated the next time it was viewed in thumbnail view. A
further experiment was performed where the last modified date of 6 files were
altered; the times were moved backwards by 24 hours so that the modification
time of each file appeared a day earlier. The files were then viewed in Windows
Explorer thumbnail view; there was a noticeable delay in displaying the visual
thumbnails whilst they were regenerated. If the last modification date in the
original source file is altered to a time before that stored in Windows.edb, then
the thumbnail subrecord is regenerated next time it is called.
It is possible to modify the contents of a file within a hexadecimal editor,
therefore ensuring the files metadata remains accurate. This was identified by
editing a JPEG image using WinHex version 15 running from a portable storage
device attached to the virtual machine; the image was replaced by one of the
same size but with noticeable visual differences. The results showed that this
form of modification does not lead to the records within the thumbnail cache
being updated; as the checks performed on the data show the subrecord is
accurate.
6.8 Forming a relationship between the thumbnail subrecords
and the source files
The previous section discussed ways in which the information in the thumbnail
cache could potentially be manipulated; the section highlighted the importance
of relationships to provide corroborating information and make unidentifiable
tampering of data harder. This section discusses the artefacts that can assist in
Page
143