SLAMorris Final Thesis After Corrections.pdf - Cranfield University

or more fragments, showing that fragmentation is likely to be encountered on
NTFS systems, this is in contrast to FAT systems where almost 97% of files
were found to be contiguous. Approximately 44% of the total drives in the
corpus contained no fragmented files, however the total number of files found
from these drives accounted for less than 1% of the files recovered from the
entire corpus, suggesting the more files found on the drive the greater the
chance of fragmentation occurring.
Garfinkel [2007] makes an interesting statement when he discusses the
probability of encountering fragmentation is related to the individual type of the
file; user generated files such as word documents were found to have higher
fragmentation rates, possibly due to the tendency to work on such files over a
prolonged period. These results show that whilst tools such as Disk
Defragmenter exist it is still likely an analyst will find fragmented user files on
the disk. This suggests that the file types an analyst is likely to be interested in
are those most at risk of fragmentation; this suggests that fragmented file
carving may be necessary to recover relevant artefacts. Since this study was
conducted, the use of computers has altered; users are now storing vast
quantities of media such as music and videos on their machines. The media
can take up a significant amount of space; whilst the size of storage media is
also increasing, the large volume of data being stored still suggests a greater
chance of encountering fragmented files. Since the thumbnail cache stores
information relating to user files, it is likely to become fragmented if enough user
files are added that generate thumbnail cache content. This is particularly likely
if the additions are done over a prolonged period as the additional clusters
required to store the new subrecords may not be available contiguously on the
storage media.
Fragments can be classified based on pattern recognition statistics; a prototypic
histogram is used in a supervised learning environment to attempt to model file
types, and research has shown this to be reasonably successful with a low error
Page
163