SLAMorris Final Thesis After Corrections.pdf - Cranfield University

ate for HTML and JPEG files [Veenman, 2007]. Veenman also establishes the
need to combine such techniques with pre-existing carving techniques in order
to maximise the information being carved, which may take a greater length of
time to run on a given storage device. To date, such techniques have been
relatively separate in their research and implementation, and whether
developing a tool encompassing several methods would decrease the error rate
on more complex file types is still unknown.
Calhoun [2008] looked at predicting the file types of fragments using linear
discriminant and longest common substrings. It was found that using longer
byte sequences for statistical analysis would improve the prediction rate of the
linear discriminant method; this may be due to the fact that information is
normally stored in several bytes. Veenman [2007] also looked at statistical
methods for identifying fragments but used data surrounding the fragments
being tested to provide a context. Providing information which places a
fragment in context of its location and surrounding information is useful during
an analysis as it may assist with identifying the likely type of smaller fragments
and providing an overall timeline of the activity on the machine.
7.3.2 Neural Networks
Whilst tools currently used by analysts, such as Encase and FTK, rely on
header and footer information for the majority of their carving, a criminal may
alter such information to prevent automated software finding the files. If these
tools were the only method of investigation on a case such evidence may not be
discovered. Neural Networks are adaptive and research has shown they may
identify tampered documents which are otherwise overlooked. Harris [2007]
investigated the possibility for recovering binary file types, and whilst his results
showed that such networks could identify several important file types, a number
of factors may improve upon his research. Firstly, Harris used back propagation
to adjust the weights on the network, and whilst this is a common algorithm for
Page
164