SLAMorris Final Thesis After Corrections.pdf - Cranfield University

more suited to pattern recognition techniques. Methods such as the Bayesian
and Neural Networks take in a variety of input and aim to put a fragment into the
category it most likely belongs to. The techniques could not improve upon the
Brute force and Structural and Syntactical approaches for identifying structured
information with metadata; the pattern recognition techniques improved the
identification of image-only data. Whilst given infinite resources it is possible for
an analyst to examine and classify each fragment individually for H1, H2, and
H4, it would be difficult for an analyst to identify fragments belonging to H3 and
H5. Such fragments which would be difficult for a human to identify have unique
patterns which a machine can use to learn which classification is the most likely
for a given input.
The Bayesian approach takes the likelihood of a node occurring in both the
classification and in other circumstances into consideration to build a statistical
model based upon the training data. The use of statistical modelling allows a
fragment which does not perfectly fit the structural and syntactical model to be
classified; this allows for variations outside the observed data. The Bayesian
network is designed using expert knowledge about the domain to construct a
model to form relationships between characteristics. The Neural network uses
the same input information as the Bayesian network but allows the machine to
interpret the relationship between features and classification. This suggests that
theneural network has the capability to assign weight to relationships differently
to an analyst which may assist with classification.
7.12 Discussion
The hypothesis of this research focused on the evidential value of thumbnail
cache file fragments identified in unallocated space. The potential size of
unallocated space on a storage device makes the individual analysis of each
cluster infeasible; therefore a method for the automated identification of
information was required. At the time of conducting this research there was little
Page
198