SLAMorris Final Thesis After Corrections.pdf - Cranfield University

1.2 Justification
The thumbnail cache can provide an analyst with information about potential
system and user activity. This is highlighted in cases such as United States V.
Vosburgh [2010] and R v Ross Warwick Porter [2006] where the information
contained within the thumbnail cache and the user behaviour that led to its
presence on the system are important evidential concerns (See Chapter 4). An
analyst interprets each artefact in the context of the system: by reconstructing
the behaviour of the system it is possible to identify how events occurred and
prove or disprove the hypothesis relating to the case. This process of contextual
analysis suggests that the Forensic Computing community needs to be aware
of both the structure and behaviour of an artefact in order to interpret its
significance in a case. The thumbnail cache does not have a generic
implementation and therefore understanding the unique structure and behaviour
of each thumbnail cache can assist with interpreting the behaviour it represents.
The growing interest in privacy and increased understanding of technology has
led to an increase in user awareness of system files. For example, information
about thumbnail cache can be found on sites such as YouTube [2013],
Facebook [2013] and Twitter [2013], which highlights the growing interest
amongst users in understanding system files. This has led to users attempting
to disguise their behaviour by deleting system and user files which contain
potential evidence of their activities. Therefore it is becoming increasingly
important to look for crucial evidential artefacts that may be present in
unallocated space.
Files in unallocated space may become partially or completely overwritten,
which may leave only fragments of the file on the system. Most file carving
techniques focus on recovery of complete contiguous files; little research has
been conducted into retrieving and reassembling individual file fragments. One
Page 2