SLAMorris Final Thesis After Corrections.pdf - Cranfield University

cache artefacts can be corroborated by forming relationships with other system
artefacts and the original source file [Sections 6.6, 6.8]; this shows that multiple
sources of corroboration for thumbnail cache evidence can be identified and in
turn those sources can be corroborated.
In Windows 7 there is a centralised thumbnail cache for each user which
contains six binary files; therefore in order to maximise the data recovered
from the live thumbnail cache it is necessary to extract the six binary files and
examine them. Windows 7 also uses the thumbs.db format, which are directory
specific thumbnail cache files. In a live file system these can be identified by
searching for the filename thumbs.db; they can then be extracted and analysed.
The carving of data relating to the Windows 7 centralised thumbnail cache from
unallocated space is discussed in Chapters 7-9.
The thumbnail cache structure and syntax identified in Section 6.4 permit the
automation of extracting data from the file formats; they also permit the
identification and reassembly of file fragments from unallocated space.
6.11 Conclusion
This chapter has examined the structure and behaviour of the operating system
thumbnail cache implemented within Windows 7. Within Windows Vista, the
thumbnail cache implementation changed significantly from Windows XP by
using a centralised thumbnail cache for each user, this implementation was
continued in Windows 7 with slight differences in the structure of records and
subrecords. The thumbnail cache contains visual thumbnail records alongside
GUID information, active drive letters and network places. Records are added to
the cache, with a new subrecord being added to the bottom of the thumbcache
files. Some records are deleted periodically, however this is application specific.
The subrecords contain checksums to assist in authenticating the data;
Page
155