SLAMorris Final Thesis After Corrections.pdf - Cranfield University

More documents

Recommendations

Info

Figure 7-3: Bayesian network for H1 and H2 classification ............................ 186 Figure 7-4: Bayesian Network for H3, H4 and H5 classification ..................... 186 Figure 7-5: Bayesian Network for H6 classification ........................................ 187 Figure 8-1: Jigsaw piece classification ........................................................... 206 Figure 8-2: Single byte frequencies for 4 visual thumbnails ........................... 211 Figure 8-3: A summary of the hybrid approach .............................................. 216 Figure 9-1: Flow Chart for File Fragment Reassembly ................................... 239 Figure 9-2: Thumbcache_IDX Classifications................................................. 241 Figure 9-3: Thumbcache_IDX reassembly ..................................................... 245 Figure 9-4: Reassembling fragments with a metadata join ............................. 249 Figure 9-5: Reassembling an image fragment................................................ 250 Figure 9-6: Calculations for image reassembly .............................................. 251 Figure 9-7: Reassembling an image by trying every permutation ................... 253 Figure 9-8: Fragment reassembly using file structure .................................... 257 Figure 11-1: A breakdown of aim of this research into smaller research problems ................................................................................................. 280 xii
LIST OF TABLES Table 5-1: A summary of the user activity which may lead to subrecords being present in the thumbnail cache ................................................................. 99 Table 6-1: A summary of the user activity which may lead to subrecords being present in the thumbnail cache ............................................................... 135 Table 7-1: Breakdown of file fragment types per classification ....................... 172 Table 7-2: Breakdown of potentially similar file fragment types in H6 ............ 173 Table 7-3: A list of thumbnail cache keywords ............................................... 176 Table 7-4: Method 1 Results for the Training Set (Half of Data Set 1) ........... 188 Table 7-5: Method 1 Results for the 1 st Testing Set (Half of Data Set 1) ........ 189 Table 7-6: Method 1 Results for the 2 nd Testing Set (Data Set 2) .................. 189 Table 7-7: Method 1 Results for the unknown data set (Data Set 3) .............. 190 Table 7-8: Method 2 Results for the Training Set (Half of Data Set 1) ........... 190 Table 7-9: Method 2 Results for the 1 st Testing Set (Half of Data Set 1) ........ 191 Table 7-10:Method 2 Results for the 2 nd Testing Set (Data Set 2) ................. 191 Table 7-11: Method 2 Results for the unknown data set (Data Set 3) ............ 192 Table 7-12: Method 3 Results for the Training Set (Half of Data Set 1) ......... 192 Table 7-13: Method 3 Results for the 1 st Testing Set (Half of Data Set 1) ...... 193 Table 7-14: Method 3 Results for the 2 nd Testing Set (Data Set 2) ................ 193 Table 7-15: Method 3 Results for the unknown data set (Data Set 3) ............ 194 Table 7-16: Method 4 Results for the Training Set (Half of Data Set 1) ......... 194 Table 7-17: Method 4 Results for the 1 st Testing Set (Half of Data Set 1) ...... 195 Table 7-18: Method 4 Results for the 2 nd Testing Set (Data Set 2) ................ 195 Table 7-19: Method 4 Results for the unknown data set (Data Set 3) ............ 196 Table 7-20: Percentage Success and False Positive rate for each method for Data Set 2 ............................................................................................... 197 Table 8-1: JPEG sequence markers found in Visual thumbnails .................... 213 Table 8-2: Results of visual thumbnail JPEG method .................................... 214 Table 8-3: Percentage success and false positive rates for the H3 method ... 214 Table 8-4: Method 5 Results for the Training Set (Half of Data Set 1) ........... 223 xiii
Page 1: CRANFIELD UNIVERSITY SARAH LOUISE A
Page 5 and 6: ABSTRACT This thesis establishes th
Page 7 and 8: ACKNOWLEDGEMENTS “And above all,
Page 9 and 10: TABLE OF CONTENTS ABSTRACT ........
Page 11 and 12: 6 The structure and behaviour of th
Page 13 and 14: 8.6.1 Stage 1: Preliminary Checks .
Page 15: LIST OF FIGURES Figure 1-1:A breakd
Page 21 and 22: 1 Introduction 1.1 Introduction In
Page 23 and 24: potential difficulty is the identif
Page 25 and 26: This is followed by a structural an
Page 27 and 28: Chapter 6 describes the structure a
Page 29 and 30: Chapter 11 evaluates the methodolog
Page 31 and 32: 2 Related Research 2.1 Introduction
Page 33 and 34: Generally individuals, including so
Page 35 and 36: thought to be a disciplinary offenc
Page 37 and 38: 2.2.2 Tools used in Forensic Comput
Page 39 and 40: structure and behaviour. Winhex pro
Page 41 and 42: with it are important aspects of an
Page 43 and 44: An important question for each arte
Page 45 and 46: For this research it is necessary t
Page 47 and 48: 2007], which assist in building eve
Page 49 and 50: and therefore he did not have priva
Page 51 and 52: data may be affected by the behavio
Page 53 and 54: thumbnail cache is implemented in f
Page 55 and 56: available for office documents; the
Page 57 and 58: future. It is possible to establish
Page 59: structure and syntax the user and s
Page 62 and 63: Identify existing file carving tech
Page 64 and 65: throughout this research. Within th
Page 66 and 67:
corroborate the results. Time const
Page 68 and 69:
4.2.1 Legal Constraints The law can
Page 70 and 71:
to the evidence and to ensure any a
Page 72 and 73:
To ensure the evidence is accurate
Page 74 and 75:
evidence being extracted is crucial
Page 76 and 77:
analyse human behaviour, it can sti
Page 78 and 79:
4.3 Criteria for evaluating the evi
Page 80 and 81:
In order to determine an artefact w
Page 83 and 84:
5 The Structure and Behaviour of th
Page 85 and 86:
the way data changes. The experimen
Page 87 and 88:
5.4 Default Installations This sect
Page 89 and 90:
Figure 5-3: The structure of thumbn
Page 91 and 92:
these can be identified by the addi
Page 93 and 94:
The tEXt chunks contain the metadat
Page 95 and 96:
holds information about sample dept
Page 97 and 98:
Start of tEXt Chunk This tEXt chunk
Page 99 and 100:
00 00 00 2074 45 58 7453 6F 66 74 @
Page 101 and 102:
order to establish if the software
Page 103 and 104:
Each piece of software installed by
Page 105 and 106:
which is present in the subrecords
Page 107 and 108:
5.6.2 The modification of subrecord
Page 109 and 110:
ascertain if unused subrecords woul
Page 111 and 112:
in thumbnail view. This shows that
Page 113 and 114:
5.9.1 Metadata There are three dist
Page 115 and 116:
only information which does not con
Page 117 and 118:
information in the .thumbnails cach
Page 119 and 120:
uses substantially more checks whic
Page 121 and 122:
any manipulation to appear as stand
Page 123:
highlighting the need for understan
Page 126 and 127:
elationship between information con
Page 128 and 129:
document the state of a default Win
Page 130 and 131:
Figure 6-1: Directory structure for
Page 132 and 133:
Clone 1-8: Directories at level 0 w
Page 134 and 135:
Figure 6-2: The centralised thumbna
Page 136 and 137:
Start of Record 87 F7 6A 62 4B 7B C
Page 138 and 139:
Start of standard thumbnail cache s
Page 140 and 141:
Start of subrecord 14F8CE010 43 4D
Page 142 and 143:
6.5 Identifying the behaviour The t
Page 144 and 145:
greater than the maximum size image
Page 146 and 147:
experiment was repeated with a non-
Page 148 and 149:
to be shown [Douglas, 2009].Figure
Page 150 and 151:
6.5.1.2 Circumstances where informa
Page 152 and 153:
thumbnail cache based solely upon t
Page 154 and 155:
the cache to remove inactive record
Page 156 and 157:
6.6.1 Windows.edb The database for
Page 158 and 159:
Figure 6-10: Identifying the Defaul
Page 160 and 161:
thumbnail view for 30 seconds. Upon
Page 162 and 163:
checks are performed on the associa
Page 164 and 165:
showing a relationship between info
Page 166 and 167:
The type of a file can be identifie
Page 168 and 169:
The event timeline created could th
Page 170 and 171:
6.9.2 Media thumbnails In Windows 7
Page 172 and 173:
the provenance of artefacts. This i
Page 174 and 175:
6.10.2 Interpretation of Results An
Page 176 and 177:
however it is still possible to tam
Page 178 and 179:
implementations of the thumbnail ca
Page 180 and 181:
valid results only when the file is
Page 182 and 183:
7.3.1 Statistical Methods If docume
Page 184 and 185:
ate for HTML and JPEG files [Veenma
Page 186 and 187:
Having described current methods fo
Page 188 and 189:
previous experiments or downloaded
Page 190 and 191:
L2: The fragment is part of a visua
Page 192 and 193:
Table 7-1: Breakdown of file fragme
Page 194 and 195:
approximately half the data in Data
Page 196 and 197:
Table 7-3: A list of thumbnail cach
Page 198 and 199:
Figure 7-2: Classifications for thu
Page 200 and 201:
7.7.2 H2 For the identification of
Page 202 and 203:
Relative offset: 48 0B 09 0C 11 0F
Page 204 and 205:
The Bayesian Network takes into acc
Page 206 and 207:
Figure 7-3: Bayesian network for H1
Page 208 and 209:
Actual Fragment Type(Percentage) 7.
Page 210 and 211:
Actual Fragment Type(Percentage) Ta
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Table 7-19: Method 4 Results for th
Page 218 and 219:
more suited to pattern recognition
Page 220 and 221:
and 2. This is possible because the
Page 222 and 223:
This chapter has successfully ident
Page 224 and 225:
8.2 Problem Definition In the intro
Page 226 and 227:
information to examine at the end o
Page 228 and 229:
files is described on the Joint Pho
Page 230 and 231:
were not from thumbnail cache files
Page 232 and 233:
In order to identify potential H3 f
Page 234 and 235:
Actual Fragment Type (Percentage) p
Page 236 and 237:
Figure 8-3: A summary of the hybrid
Page 238 and 239:
cache file fragments. The headers i
Page 240 and 241:
follow the standard PNG specificati
Page 242 and 243:
then be viewed by an analyst and us
Page 244 and 245:
Actual Fragment Type (Percentage) T
Page 246 and 247:
8.8 Discussion The end aim of Chapt
Page 248 and 249:
identification method into stages l
Page 251 and 252:
9 Thumbnail cache fragment reassemb
Page 253 and 254:
Once the fragments have been identi
Page 255 and 256:
9.3.2 Logging In order to maintain
Page 257 and 258:
H1:Thumbcache_idx.db file H2: Image
Page 259 and 260:
Therefore this research assumes tha
Page 261 and 262:
ecords and 2 partial records. The n
Page 263 and 264:
equirement for generating table siz
Page 265 and 266:
100% success rate, with 0% false po
Page 267 and 268:
then stored and marked as a complet
Page 269 and 270:
Once a start of file fragment has b
Page 271 and 272:
number of fragments which contain o
Page 273 and 274:
Figure 9-7: Reassembling an image b
Page 275 and 276:
As the number of fragments being an
Page 277 and 278:
file fragment identification on sto
Page 279 and 280:
Linux Category_4: The last fragment
Page 281 and 282:
Table 9-1: Results from reassembly
Page 283 and 284:
activity. All the non-standard subr
Page 285 and 286:
which substantially reduces the inf
Page 287 and 288:
10 Establishing the evidential valu
Page 289 and 290:
The thumbnail cache artefact extrac
Page 291 and 292:
and 6. Each stage of the method has
Page 293 and 294:
adapted to extract artefact from ot
Page 295 and 296:
10.7 Discussion Both live system an
Page 297:
10.8 Conclusion This chapter evalua
Page 300 and 301:
Figure 11-1: A breakdown of aim of
Page 302 and 303:
analysing the file type it is possi
Page 304 and 305:
singular file fragment; by combinin
Page 306 and 307:
processing time of the reassembly m
Page 308 and 309:
In Chapter 9.5 a decision was taken
Page 311 and 312:
12 Conclusions and future work 12.1
Page 313 and 314:
potential for improving the identif
Page 315:
installations of the operating syst
Page 318 and 319:
Carnagey, N.L., Anderson, C.A. & Bu
Page 320 and 321:
Facebook, 2013. Facebook. Available
Page 322 and 323:
Helix, 2011. Helix. Available at: h
Page 324 and 325:
Noblett, M., Pollitt, M., Presley,
Page 326 and 327:
Stone-kaplan, K., Roter, M., 2003.
Page 329:
APPENDICES Cranfield University | 3
Page 332 and 333:
A.1.3 Image File Header typedefstru
Page 335 and 336:
Appendix B Bayesian probability tab
Page 337 and 338:
B.8 Fragment contains the ASCII str
Page 339 and 340:
B.15 32 byte record structure SR po
Page 341 and 342:
B.19 H3 Each byte frequency is less
Page 343 and 344:
B.21 H5 Stored in valid PNG chunks
Page 345 and 346:
Appendix C Peer Reviewed Publicatio
Page 347 and 348:
Cranfield University | 327
Page 349 and 350:
Page 351 and 352:
Page 353 and 354:
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Page 373 and 374:
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
Page 393 and 394:
Page 395:
show all

SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Create successful ePaper yourself

Delete template?

Save as template?