SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Having described current methods for the identification of deleted file fragments
it is possible to take a single method with reasonable performance statistics,
adapt it for fragment identification and apply it to the thumbnail cache file type.
However this method would establish only the ability of the method being
implemented to identify thumbnail cache file fragments, whereas a comparative
study of the most commonly implemented methods would assist in
implementing a single method with higher rates of identification for thumbnail
cache files. A comparative study also prevents bias on the results of this
research which the use of a single method may give and provides an
opportunity to evaluate the performance of the methods on a single file type.
Therefore the results on the file type can be accurately compared, highlighting
the strengths and weaknesses of each approach.
Trialling a variety of methods against the thumbnail cache may improve the
accuracy of recovery and allow the corroboration of results. Based on the
review of literature conducted earlier in this chapter the four types of methods
chosen for evaluation in this research are: Brute force, Structural and
Syntactical, Statistical, and Neural Network. Of each type a single method will
be implemented; the specific implementations are discussed in later sections;
each method will then be evaluated against the same test data set.
In order to identify thumbnail cache fragments using the four methods identified
it is first necessary to determine the data set which will be used to train and test
the ability of each method; this is discussed in Section 7.5. This is followed by a
description of how each of the identified methods was adapted to enable single
fragment identification; the sections also describe how each method was
applied to the thumbnail cache file formats [Sections 7.6 – 7.9]. The results of
each method are then described in Section 7.10; after the results the methods
are compared and evaluated in Section 7.11. Finally a discussion of the
Page
166