SLAMorris Final Thesis After Corrections.pdf - Cranfield University

information available about single fragment identification; particularly in cases
where the fragment classification was based solely on the information within the
fragment. This suggested that an existing method for the identification of larger
chunks of data had to be selected and adapted for single fragment
identification.
If a single method was selected and adapted then the research would be
evaluating the ability of the adapted method to identify thumbnail cache file
fragment. Therefore a comparative study was selected to attempt to maximise
the identification of thumbnail cache file fragments. The study provided an
opportunity to evaluate a variety of adapted methods on different thumbnail
cache structures; this highlighted the strengths and weaknesses of using each
approach.
The results of this research on data sets 1, 2provided 100% identification of
fragments in H1 and H2 with no false positives using the structural and
syntactical approach; H3 produced the least accurate results with a high rate of
false positives and negatives. The evaluation of file fragment identification
methods produced inaccurate results when identifying fragments which solely
contained JPEG data; this is partly due to the fact it is difficult to distinguish
between a JPEG fragment which belongs to the thumbnail cache and a JPEG
fragment which belongs to any other file. For this research it was decided that it
would be best to ensure all the JPEG fragments from the thumbnail cache were
identified; whilst attempting to minimise the false positives; this proved difficult
and most JPEG fragments were classified as thumbnail cache image
fragments. Therefore further research is required into methods of identifying
JPEG fragments in order to improve the accuracy of their carving.
The tables of results in Section 7.10 show the actual fragment classification
against the classification given to the fragment by each method for Data sets 1
Page
199