SLAMorris Final Thesis After Corrections.pdf - Cranfield University

7.6 Brute Force Approach
This approach uses a list of known hexadecimal strings which can be used to
classify potential files; if a potential fragment contains one of the known strings
it is put in the relevant classification. In Windows 7, thumbnail cache files begin
with the file signature IMMM or CMMM; the record signature CMMM also
appears at the start of each record contained in the Image files. The keyword
IMMM would identify the first cluster of the index file; given the structure of the
records in the index any further clusters belonging to the index file could not be
identified in this manner. Searching for the keyword CMMM may identify a
significant number of thumbnail cache file fragments; the keyword CMMM
should be present in most of the fragments which satisfy H2.If the metadata for
a subrecord is split over a cluster boundary then a fragment may contain
metadata without a header; the fragment may still contain an image file
signature so checks could be performed for JPEG, PNG, and BMP file headers.
The image data only fragments do not contain any keywords and therefore
cannot be identified using this method.
Visual thumbnails in the Ubuntu and Kubuntu thumbnail cache files are stored
in individual PNG files and therefore contain standard PNG identifiers such as
chunk names [Chapter 5]; the files also contain thumbnail specific metadata
chunks with identifiers that could be searched for. With the establishment of
keywords and file signatures [Table 7.3] which could be used to search for
thumbnail cache file fragments a simple program was created which takes a
fragment of data at a time and examines it for the identified keywords. Any
fragment which contained a keyword was then extracted and stored in a
directory for the relevant classification; the classifications relating to each
keyword are shown in table 7.3.
Page
175