SLAMorris Final Thesis After Corrections.pdf - Cranfield University

then be viewed by an analyst and used by the reassembly methods
implemented in the next Chapter. When a fragment is copied it is given a file
header which contains metadata about the fragment. The header contains:
Signature [“TCFRAG”]
Individual fragment identifier [8 bytes]
Path of original file [44 bytes]
Relative position in file [8 bytes]
Classification [4 bytes]
The file signature identifies the fragment as a thumbnail cache file fragment.
The individual fragment identifier is a unique number based upon the order the
fragments are processed; the first fragment of a batch to be processed is given
the number 1. The path of the original file and relative offset in the file allows an
analyst to maintain a relationship between each fragment and the original
source file. The classification holds in ASCII the classification of the fragment in
the first 2 bytes; the third byte is used to store the sub-category, and the fourth
byte is set to 0xFF if the fragment begins with a thumbnail cache file header.
8.7 Results
This section contains the results of testing the hybrid thumbnail cache file
fragment identification method against the data sets used in Chapter 7.
Page
222