SLAMorris Final Thesis After Corrections.pdf - Cranfield University

In each experiment a single variable was altered on all of the files; for example
variables included: changing the file path, changing the volume the file was
stored on, changing dates/times of both the system and the files. After each test
the resulting thumbnail cache was extracted and compared with the original
thumbnail cache; therefore any changes made to the thumbnail cache ID values
could be identified. The results of this testing have shown this ID is comprised
of data relating to the user file; it has been identified that the thumbnail cache ID
is related to the volume, MFT data and the type of the file.
This suggests that there is no straightforward way of recovering the file path
from the thumbnail cache ID; however, in Section 6.6.1 the thumbnail cache ID
is used to form a relationship through the Windows Desktop Search database.
6.8.4 Event timeline
It is possible to identify the order user created files were added to the thumbnail
cache by identifying their position in the individual thumbnail cache files.
Section 6.6.4 identified that it is possible for subrecords which do not contain
visual thumbnails to move closer to the top of thumbnail cache files over time.
Section 6.5.1 described an experiment which suggested that new subrecords
containing visual thumbnails were appended to the bottom of the thumbnail
cache files; they also maintained their relative positions in the thumbnail cache
overtime. Therefore for user generated files the related subrecords in the file
appear in the order they were created by the system. This can assist with
creating an event timeline as a subrecord can only be created for an original
source file which has a relationship with the operating system at the time of
creation. A relationship between the original source file and the operating
system is defined as the file being viewable within the operating system. In
order to add extra data to the event timeline it is possible to add metadata
recovered from the subrecords, windows.edb, and the user created source file.
Page
147