SLAMorris Final Thesis After Corrections.pdf - Cranfield University

implementations of the thumbnail cache; therefore the approach used in this
research could enable the identification of other file types.
This chapter investigates methods for identifying thumbnail cache file
fragments. Section 7.2discusses traditional data carving techniques; recent
data carving research is discussed in Section 7.3. In Section 7.4 a
methodology for the research in this chapter is established; the information to
be carved is described in Section 7.5. This is followed by the four most
common types of identification method being adapted and implemented for
thumbnail cache file fragment identification [Sections 7.6 – 7.9]. Section 7.10
describes the results of the implemented file fragment identification methods; a
comparative discussion of the four techniques follows in Section 7.11. A
discussion of this research is provided in Section 7.12; finally this chapter is
concluded in Section 7.13.
7.2 Traditional Data Carving
Both NTFS and FAT store information showing a relationship between
individual clusters and their contents. The references in the file system provide
a starting point to identify the clusters used to store a file. Fellows [2005]
discusses the recoverability of deleted files when the directory structures such
as the MFT are available; however the paper has little discussion on the
recoverability of potential evidence from such files when the MFT information
relating to a cluster is no longer available. There may be information on a
device which does not have any file system references but is pertinent to the
investigation; the file system references may not always be available, for
example if the device has been formatted.
Without the file system references, recovery becomes more complex; this
creates a requirement for file carving. File carving is the technique of extracting
Page
158