SLAMorris Final Thesis After Corrections.pdf - Cranfield University

6.10.2 Interpretation of Results
An analyst may be presented with a scenario where doubt is cast upon whether
the system was working properly at the time of the alleged incident. The
manipulation of thumbnail cache artefacts was evaluated in Section 6.7. The
section showed methods of verifying and corroborating the artefacts in the
thumbnail cache to ascertain the likelihood they were created whilst the system
was working normally. It is a non-trivial task to alter all the relationships within
the system which relate to the thumbnail cache; therefore it is likely an analyst
would find some information to cast doubt on the manipulated data. The
experiments performed in Sections 6.4 - 6.6 were based on a system
functioning normally and document the expected results of certain behaviours.
By establishing relationships between the thumbnail cache and the rest of the
system it is possible to analyse the information in the thumbnail cache in the
context of the general system activity; therefore the behaviour an artefact
represents can be established [Section 6.5].
Thumbnail cache artefacts can be corroborated by forming relationships with
other system artefacts [Section 6.6]. Artefacts such as a GUID within a nonstandard
thumbnail cache entry can be difficult for an analyst to place into
context without supplementary information. However if a relationship is formed
between the thumbnail cache entry and the registry it is possible to determine
the meaning of the GUID and create further relationships to provide additional
information. Relationships between thumbnail cache artefacts and the original
source file can also assist an analyst; the potential system behaviour identified
from thumbnail cache and corroborating artefacts can be linked to a specific file.
By forming relationships with other sources of information and continuing to
build relationships until all the links between artefacts are identified it is possible
to maximise the corroboration of thumbnail cache artefacts. The thumbnail
Page
154