SLAMorris Final Thesis After Corrections.pdf - Cranfield University

cache file fragments. The headers identified in the first check using the WinHex
file are used again for this extensive check of the entire fragment. If a header is
found which is not part of a thumbnail cache file the fragment is rejected. As the
Linux visual thumbnails are stored in individual PNG files the PNG header
signature will only be found at the start of a fragment and would therefore have
been identified in the first check of this stage. If the fragment contains a JPEG,
PNG or BMP header the fragment is passed to Stage 3 as these are the file
types used to store visual thumbnails in the Windows 7 thumbnail cache.
After the final preliminary check if the fragment has not been rejected or passed
directly to another stage it is passed to Stage 2.
8.6.2 Stage 2: H1 Validation Checks
If the fragment completes the Stage 1 checks and is not rejected or identified as
containing a thumbnail cache file H2 or H4 file header then it is assessed for H1
classification; given the ability of the structural and syntactical approach to
identify H1 fragments with no false positives it was decided to use the checks
defined in Section 7.7.1. If these checks are all positive the fragment is
classified as H1; if any check fails the fragment is passed to H2.
8.6.3 Stage 3: H2 Validation Checks
A fragment can be passed to stage 3 by either stage 1 or 2. If the fragment is
passed directly from Stage 1 then it begins with the file signature “CMMM”; in
this case if the fragment belongs to a thumbnail cache the file signature is either
followed by the remainder of the thumbnail cache file header or the subrecord
header structure. In Section 7.7.2 the implementation for identification of H2
fragments using the structural and syntactical approach was described. The
method identified all the thumbnail cache file fragments in the three data sets
used in the previous chapters without identifying any false positives. Therefore
Page
218