SLAMorris Final Thesis After Corrections.pdf - Cranfield University

The cases are checked in order from 1-4; for each case if any of the checks are
failed then the case is rejected and the next case validation checks are
performed. If the fragment fails the checks for all 4 cases the fragment is
rejected for H2; the fragment is then tested for the H3 classification.
7.7.3 H3
The H3 classification relates to a JPEG thumbnail cache image fragment which
does not contain metadata. Such fragments may not contain any information
which an analyst could classify by a quick visual inspection. The JPEG file
format is a binary file type that stores information in chunks; each chunk has an
identifying marker to denote its type. The start of a visual thumbnail may occur
in a fragment which also contains subrecord metadata; in this case the fragment
would be categorised as H2. If the subrecord header is not in the same
fragment as the start of the visual thumbnail, then the JPEG file signature
0xFFD8 would be identified; the data preceding the JPEG file signature could
be checked to ascertain if it meets the structure and syntax of an image
thumbnail cache file.
The first 623 bytes of each JPEG visual thumbnail from the thumbcache_256
files examined during this research was found to be the same; the first 623 byes
of JPEG visual thumbnails from the thumbcache_1024 files examined during
this research were also found to be the same as each other. Whilst each size of
JPEG visual thumbnail shared a common 623 bytes at the start there was a 3
byte difference between the two thumbcache files. Therefore 2 sequences of 16
bytes were selected from the common information; the sequences were
searched for in the first 623 bytes of each fragment. If a sequence was
identified, then the surrounding area of the fragment was checked to ensure it
contained the expected sequence. The sequences and the relative offsets from
the start of the visual thumbnail are shown below:
Page
181