SLAMorris Final Thesis After Corrections.pdf - Cranfield University

showing a relationship between information contained with the thumbnail cache
and a thumbnail cache source file. This is achieved by evaluating the metadata
and images both within the cache and source file; finally the use of event
timeline reconstruction in forming a relationship is considered.
Establishing a relationship between a file created by a user and the thumbnail
cache can assist in corroborating the information identified; it can also assist in
forming an overview of the user’s interaction with a file. This section describes
the ways in which a relationship can be formed between a thumbnail cache
record and a user generated file.
6.8.1 Visual Thumbnail
A visual thumbnail provides a snapshot of at least part of a file at a point in the
file’s history; if the visual thumbnail relates to the current state of the file then a
visual comparison could be performed to identify if there is any similarity in its
content to a user file. If the visual thumbnail and a user file appear to contain
the same data then there may be a relationship between the two sets of
information; an analyst cannot be certain the two sets of data are related. For
example, there may be multiple copies of a file on the user’s system, in which
case all the copies may visually match with the same subrecord however only
one copy would have a relationship with it.
The visual thumbnail may be compared to part of a user file using computer
vision techniques; if the two images are the same size then a one-to-one
mapping could be applied [Dufournaud, 2000]. However given it is likely that the
two images are different sizes and may also be in different image formats the
problem involves a one-to-many mapping; the increased requirement for the
calculation of mappings may mean the technique is too resource intensive for
large data sets and would therefore require the data set to be pre-processed.
Page
144