SLAMorris Final Thesis After Corrections.pdf - Cranfield University

8.6.1 Stage 1: Preliminary Checks
Each fragment starts in the ‘preliminary checks’ section which aims to quickly
remove fragments which are not part of the thumbnail cache. Firstly the
fragment is assessed to see if it contains a known file signature; if the signature
is from an irrelevant file type it is automatically rejected. If a file signature
header of “IMMM”, “CMMM” or “PNG” was identified the fragment was passed
directly to Stage 2, 3, and 5 validation checks respectively; the values
represent header signatures which are found at the start of thumbnail cache
files. Known file types were established using the known file signatures listed in
the WinHex 16.0 file “File Type Signatures Search.txt”. Further potential file
system fragment headers were also included such as the start of an NTFS
volume “0xEB52904E544653” and the MFT record header “0x46494C4530”;
this was based on the information provided about file systems by Sammes
[2008] and was used to exclude known H6 fragments.
The second check identifies whether the fragment contains solely a single hex
value for example 0x00 or 0xFF; as thumbnail cache fragments are not likely to
be made up solely of a single value such fragments are automatically rejected.
Thirdly checks are performed to ascertain whether the fragment consists mostly
of ASCII or Unicode values. In order to perform these checks the hex values of
the fragment are considered. If 90% or more of the bytes in the fragment fall
between 0x41 and 0x7A the fragment contains mainly ASCII characters and is
rejected. If 80% or more of the double bytes in the fragment fall between
0x0030 and 0x007A the fragment contains mainly Unicode characters and is
rejected.
The final preliminary check is to ascertain if the fragment has a compound
structure; file types can be contained within compound structures and therefore
a header signature may appear anywhere within a fragment. Only image file
types (JPEG, BMP, and PNG) are valid headers to be found within thumbnail
Page
217