SLAMorris Final Thesis After Corrections.pdf - Cranfield University

potential difficulty is the identification of a file fragment with the small amount of
information they contain. The potential importance of thumbnail cache files and
their varied structure suggests that research into retrieving and understanding
the evidential value of these fragments could assist in providing additional
artefacts in a case. These additional artefacts may alter or corroborate an
existing event reconstruction and help to ensure a suitable conclusion is
reached.
1.3 Aim
Understanding and recovering the data contained within the thumbnail cache is
a relevant problem in the forensic computing community. As the level of
understanding of a general computer user increases it becomes more likely that
a user who wishes to conceal evidence of his activity will attempt to remove
relevant data from his system. If the user simply deletes relevant artefacts the
data will remain resident on the storage device until the clusters they occupy
are reassigned to new data; therefore it is likely that clusters containing relevant
artefacts may exist on the system in unallocated space. The aim of this
research is to evaluate the evidential value of thumbnail cache file fragments
identified in unallocated space.
1.4 Hypothesis
Operating system thumbnail caches can provide important sources of evidence
in a forensic computing investigation. Therefore the research hypothesis is
Thumbnail cache file fragments identified in unallocated space contain artefacts
of evidential value that may provide potential evidence when the thumbnails
have been deleted from the live thumbnail cache of the system.
Page 3