SLAMorris Final Thesis After Corrections.pdf - Cranfield University

the provenance of artefacts. This is followed by the criteria for assessing the
interpretation of results.
6.10.1 Provenance of Artefacts
This chapter has identified the structure and represented behaviour of
thumbnail cache artefacts identified in Windows 7. An analyst could use the
experimental methods described throughout this chapter (for example Section
6.2) to replicate the experiments and verify the artefacts presented. The ability
to replicate the results based on the descriptions provided in this chapter show
the use of clear documentation; an analyst would be familiar with this style of
documentation.
The thumbnail cache structure is identified in Section 6.4; this led to
experiments to determine the types of behaviour which can lead to the addition,
modification, or deletion of data from within the thumbnail cache [Section 6.5].
This information was corroborated by forming relationships with other artefacts
in the system and with the user generated source as described in Sections1.6
and 1.8.The thumbnail cache artefacts identified during this research are
justifiable as they are identified using a standard replicable process that
enables the verification of the artefacts presented.
The features identified in the thumbnail cache motivate the requirement to
identify and provide corroboration. For example, an analyst may be
investigating claims that the suspect was unaware of terrorist material on their
computer and that it was automatically downloaded. The thumbnail cache may
contain several different sized visual thumbnails, metadata about the original
file, and in conjunction with other system information it is possible to corroborate
the path of the original file. If a record is present for any of the material in the
thumbnail cache the analyst can determine potential user activity which may
Page
152