SLAMorris Final Thesis After Corrections.pdf - Cranfield University

and had a high number of false positives; therefore further research into the
format of H3 fragments is required to assist with maximising the data recovered.
Each method used in the previous research had different strengths; methods 1
and 2 produced the most accurate results on structured information with a
known syntax. Method 3 produced accurate results with a file which had a
known but variable structure; both methods 3 and 4 improved the accuracy of
pattern matching for the image only fragments. If the strengths of each method
were utilised it may be possible to construct a single approach to identifying
thumbnail cache file fragments. In order to compare any new implementation to
the previous methods the information to be carved should remain as described
in Section 7.5. In order to successfully maximise the data recovered and
maximise the relationships formed it is necessary to both identify thumbnail
cache file fragments and to reassemble the files where possible. The
reassembly of a thumbnail cache file would assist with forming relationships
between artefacts and provide contextual information about any artefacts
recovered. Therefore it is necessary to consider the potential input requirements
of reassembly methods to ensure the output produced from this research is
suitable for the next stage of this research project.
For this research it is necessary to consider the feasibility and performance of
the reassembly approach. If fragments have not been successfully identified
then it will not be possible to completely reassemble the information; this
suggests that it is better to identify all relevant fragments and have some false
positives than to fail to identify a relevant fragment. However a large number of
false positives can reduce the feasibility of the reassembly method. For
example a large number of false positives may result in a substantial number of
comparisons which may significantly impact the processing time required to
complete the reassembly process. It may also affect the number of false
positive reassembled files produced. This would mean an analyst had more
Page
205