SLAMorris Final Thesis After Corrections.pdf - Cranfield University

previous experiments or downloaded from file type specific searches made
using Google.
Data Set 2
The second data set represented a real world case with a larger range of file
types and usage. The live files were taken from both machines and organised in
directories by extension. The data set which contained 1.3TB of files taken from
the main computer used for the 18 month period before this research was also
collected; as the computer had significant use over this period it had completed
a large variety of tasks and contained a significant amount of user data. In
addition in order to study the growth of the thumbnail cache in Windows 7
during this research, the thumbnail cache directory was made read only; this led
to a thumbnail cache with a total size of 23 GB and 827 temporary thumbnail
cache files being created. An 80 GB Ubuntu machine used during the same
time period was also included in this data set; the machine had a similar range
of usage and contained significant amounts of user generated data.
Data Set 3
The final data set consisted of the free space from all the storage devices used
in Data Sets 1 and 2. This unknown data provides a second set of test data
where little is known about the contents before the identification methods are
used. The free space contains unknown file types which may generate false
positive results from the identification methods. It also provides an opportunity
to identify any thumbnail cache file fragments in unallocated space on the
systems analysed during this research. In Windows 7 the free space from data
set 1 was 490 GB, and set two provided 687 GB of data. The data collected
from the free space would have been too resource intensive to analyse by
hand, and is therefore 1177 GB of unknown data.
Page
168