SLAMorris Final Thesis After Corrections.pdf - Cranfield University

7.5.2 File Fragment Classification
In order to identify thumbnail cache file fragments each type of fragment
requires a classification; each class represents a file fragment with different
characteristics. Initially classifications for each operating system were
considered individually; after refining the classifications for Windows 7 fragment
identification 4 classes of fragment were created:
W1:The fragment is part of the thumbcache_idx.db file
W2: The fragment is part of an image thumbcache file and contains
metadata
W3: The fragment is part of a thumbcache file and only contains image data
W4: The fragment is not part of the Windows 7 thumbnail cache
Visual thumbnails are generally stored in one of three image formats: JPEG,
PNG and BMP; BMP is generally only used to store visual thumbnails in the
smaller cache files and therefore it is most likely that image-only data fragments
will only be present for JPEG and PNG image formats. Since PNG files are
present in the Linux thumbnail caches this research will focus on JPEG images
for W3.
In Chapter 5 it was established that visual thumbnails in Linux are stored in
individual PNG files and contain thumbnail specific metadata. For this research,
this led to the creation of three classifications for Ubuntu and Kubuntu fragment
identification:
L1: The fragment is part of a PNG visual thumbnail and contains
metadata
Page
169