SLAMorris Final Thesis After Corrections.pdf - Cranfield University

The type of a file can be identified through the flags stored in the thumbnail
cache; each type of file has a specific sub-set of flags; these flags are found in
the main record for each file located in the thumbcache_idx.db file [Morris,
2011]. The flags can be used to identify the type of file which relates to the
record, as the file type may not be obvious from a visual inspection [Section
6.4.2].
6.8.3 Thumbnail cache ID
Each record contains a unique thumbnail cache ID which is made up of sixteen
hexadecimal characters. In order to ascertain the information which was used in
the formula for creating the thumbcache ID a series of tests were conducted.
The tests were conducted to investigate the possibility of a simple relationship
that allowed a file path of MFT ID to be determined from the thumbnail cache
ID. Each test was performed in a clone of the baseline virtual machine with a
set of 20 user created files stored in the current user’s “My Documents”
directory; the images were viewed using Windows Explorer in order to create a
baseline thumbnail cache. The files selected were: 2 BMP, 2 DOC, 2 DOCX, 2
GIF, 5 JPEG, 3 PDF, 2 PPT, and 2 XLS.
Figure 6-13: Restore points for the directory Explorer
Page
146