SLAMorris Final Thesis After Corrections.pdf - Cranfield University

adjusting weights, techniques such as those utilised by Fogel [2001], using
evolutionary algorithms based on a Darwinian approach, could also have been
employed and may have increased the adaptability of the network [Russell,
2003]. Harris also used a training set that was ten times larger than the testing
set. Decreasing the size of the training set and altering the proportions of each
file type may have increased the recognition for the file types, preventing the
network from becoming over trained, losing the ability to generalise to new files.
7.3.3 Recovering deleted information from other operating systems
Whilst analysts are most likely to come across Windows operating systems,
they may also see Mac and Linux based systems too [Burghardt, 2008].
Deleted files in OS X have been the subject of research, by establishing if any
given sector which is known to contain a deleted file has been overwritten; it is
possible to calculate the chance of recovering useful evidence from the file. This
is a useful technique, as the method identifies where blocks containing deleted
information should be and in comparing them to the volume bitmap it can see if
they have been overwritten. The technique is also limited in that it relies upon a
complete and accurate entry in the journal; a log of file changes on the disk, and
would therefore not provide assistance in cases where this is corrupt.
7.4 Methodology
The aim of this chapter is to evaluate methods to identify thumbnail cache file
fragments. The methods described earlier in this research were based upon the
identification of file fragments which consisted of multiple clusters. This
research focuses on identifying single fragments of thumbnail cache files,
without using any information outside the fragment to assist with its
identification; it has already been established that a single fragment may be all
that remains of a file. Therefore an important consideration for this research is
the identification of methods which could be adapted to identify single fragments
of information without any supplementary information about the system.
Page
165