SLAMorris Final Thesis After Corrections.pdf - Cranfield University

1 Introduction
1.1 Introduction
In computing, the term thumbnail is used to define a small representation of a
larger file. Thumbnails were originally created for visual data, such as an image,
but they have developed to include audio and multimedia formats. Thumbnails
are used in a variety of applications and operating systems to assist with the
identification of various source files. For example, when browsing directories
thumbnails can provide greater detail on the content of the file than the file
name alone. Visual thumbnails are also widely used by websites to assist a
user in browsing the content.
Whilst the use of visual thumbnails can enhance the usability of applications,
they can be resource intensive to generate, particularly if a directory contains a
large number of files which require the generation of thumbnails. A thumbnail
cache allows visual thumbnails and their associated metadata to be stored. The
cache prevents unnecessary re-rendering and therefore reduces the use of
system resources. Such caches are of particular significance to forensic
examiners as they can contain: metadata, a visual thumbnail of the original file,
and potentially can provide information about the user’s activity.
There is no standard implementation of a thumbnail cache, therefore software
applications and operating systems each use the basic concept in their own
way. This can be a source of confusion for forensic examiners as thumbnail
caches which look structurally similar may not represent the same activity, and
may therefore have a different evidential significance. In addition to the
expected visual thumbnails and associated metadata, thumbnail caches may
hold other unexpected pieces of information; such as network places and drive
allocations [Chapter 6].
Page 1