SLAMorris Final Thesis After Corrections.pdf - Cranfield University

were not from thumbnail cache files were randomly selected for comparison
from data set 1.
A small software program was implemented to analyse the frequencies of byte
patterns for up to 4 bytes to ascertain if any characteristics could be identified
for JPEG fragments. It was found that for single byte frequencies 0x00 is often
quite high, with 0xFF generally being one of the less frequent bytes; four
example images and their associated single byte frequencies are shown in
figure 8.2. For two byte frequencies there are interesting characteristics for
those starting with 0xFF; for example the set of bytes 0xFF FF does not appear
in any of the JPEG image-only thumbnail cache fragments. However the
sequence 0xFF FF did occur on multiple occasions in the non-thumbnail JPEG
fragments. This interesting characteristic is due to the use of 0xFF as the first
byte of a start of sequence marker; therefore only sequence markers used in
the JPEG specification are valid in the JPEG clusters.
A python program was written to extract each 2 byte sequence starting with
0xFF found in the Windows 7 JPEG visual thumbnails. The program found eight
unique 2 byte sequences, which are documented in table 8.1;the function of
each byte sequence is also described [Cuturicu,1999; Weeks, 1998]. Out of the
identified byte pairs, six have static positions relative to the start of the visual
thumbnail; therefore only 0xFF 00 and 0xFFD9 can occur after than the first 611
bytes of a JPEG visual thumbnail. As the first 623 bytes of a visual thumbnail
are mostly consistent if a marker is identified it is possible to check the bytes
around it and validate it occurs at the right relative offset in the visual thumbnail.
If the byte sequence 0xFFD9 occurs this should be directly followed by a
subrecord header; therefore this byte sequence is unlikely to occur in a H3
fragment.
Page
210