SLAMorris Final Thesis After Corrections.pdf - Cranfield University

((X * 2^32) + Y) Mod Z = Position in hash table within thumbcache_idx.db
Where
X is the first 4 bytes in little endian of the thumbcache ID
Y is the second 4 bytes in little endian of the thumbcache ID
Z is the number of positions currently in the hash table
[Chapter 6]
This formula can also be used to establish the possible table sizes for an index
file fragment by substituting possible values of Z, which must be multiples of
101, into the equation to identify which, if any, values of Z solve the equation.
Any value for Z which is valid for all the thumbnail cache ID’s in the fragment
can be considered a potential table size. Once a possible table size is
established it can be verified by substituting it into the equation for other records
in the same fragment. The identification of a valid possible hash table size also
shows that the thumbcache ID values are syntactically valid and provides a
substantial indication that the fragment belongs to a thumbcache_idx.db file.
After checking the thumbcache ID value, the remainder of the record structure
is checked to ensure that the fragment follows the remainder of the structure
and syntax identified in Chapter 6. The structure is followed in order starting
with checking the flags are valid; if the record is complete the flags cannot
consist solely of either 0xFF or 0x00. The remaining positions are then checked;
these cannot be equal to 0 unless the record is empty. If a record fails any of
the checks then the fragment is tested to see if it belongs to H2.
Page
179