SLAMorris Final Thesis After Corrections.pdf - Cranfield University

7.7 Structural and Syntactical Approach
The Structural and Syntactical method relies on the information gathered about
the different implementations of the thumbnail caches researched in Chapters
5 and 6; in which the structure of the files are identified along with the valid
syntax for each part of the structure. In order to automate the Structural and
Syntactical method, a program was written which begins by checking if the
fragment starts with a known file signature. If the file signature is 0x434D4D4D
or 0x494D4D4D then it may be part of a thumbnail cache file; if the fragment
starts with a known file signature that does not belong to a thumbnail cache file
then the fragment is automatically classified as H6. This is followed by the
checks described in the sub-sections below starting with those for the H1
classification; processing for each classification stops as soon as a check is
failed. If all checks for a classification are completed successfully the fragment
is classified as that type; if the fragment fails to be classified as H1 – H5 it is
automatically classified as H6 with no further checks. The following subsections
describe the characteristics of each classification of fragment which
were used for validation in this method.
7.7.1 H1:
The index files used by the Windows 7 caches (thumbcache_idx.db) store 32
byte records with the first complete record starting at byte 24 of the cluster; a
cluster can hold up to 127 complete records and may hold a file header and
incomplete records. Figure 7.2 shows the 4 possible structures of an index file
fragment; the first complete record starts 24 bytes into the fragment. Each
record should either be empty or complete; therefore the first check to identify if
a fragment belongs to an index file is to apply the basic structure to the
fragment. It was also shown that the 4 bytes of a record which show the position
of the subrecord in the thumbcache_sr.db file should either contain all 0xFF or
0x00.
Page
177