SLAMorris Final Thesis After Corrections.pdf - Cranfield University

hybrid approach may improve the accuracy of identification, and would provide
an opportunity to enhance the identification of H3 fragments; Table 7.20 shows
H3 had the lowest overall success rate during this research with the highest
success rate for this classification being 66.84%. The results tables in Section
7.10show that for most of the methods and data sets, the H3 fragments
consistently have low rates of identification.
7.13 Chapter Conclusion
This chapter described research into the identification of thumbnail cache file
fragments; this was achieved by implementing a variety of the most common file
carving methods and evaluating their performance on a corpus. If a single file
carving method had been implemented the results of the identification would
have only provided an evaluation of the method itself; therefore using several
methods provides the opportunity to enhance identification. The evaluation of
the file carving methods also provides a unique opportunity to compare the
strengths and weaknesses of each file carving approach.
The results of the comparative study showed that the H1 and H2 classifications
could be successfully identified with no false positives in the corpus. Whilst it is
noted that fragment types may exist which were not present in the corpus the
high identification rate suggests a significant reduction in the number of
fragments an analyst would have to analyse. A hybrid approach may improve
classification for H3-H5 and to improve the overall performance of the method.
Since image-only thumbnail cache fragments have similar characteristics to
standard image fragments it would be difficult to completely remove false
positive matches. The aim of this research is to identify fragments which can be
used for the reassembly research in Chapter 9; therefore a solution would be to
maximise the identification of thumbnail cache file fragments whilst minimising
false positives.
Page
201