SLAMorris Final Thesis After Corrections.pdf - Cranfield University

8.8 Discussion
The end aim of Chapters 7-9 is to identify and reassemble thumbnail cache file
fragments located in unallocated space in order to assess their evidential value.
Given this aim it is more important at this stage in the research to have too
many fragments available for the reassembly process in order to maximise the
chance of a successful reassembly. This research successfully improved the
number of JPEG image thumbnail cache file fragments identified; despite the
large number of false positives it still represents a reduction compared to the
results of Chapter 7. Despite the reduction the large number of fragments may
still significantly impact the performance of any reassembly method created.
Further identification of JPEG specific fragment characteristics enabled the
hybrid identification method created in Chapter 7 to be modified with the aim of
improving JPEG classification. When compared to the results of the previous
chapter it is clear that a noticeable improvement in the identification of JPEG file
fragments has occurred. This highlights the need to consider each different
classification of file type independently; it also highlights the need to consider
the requirements before determining appropriate classifications. For example in
this research JPEG thumbnail cache file fragments are classified separately to
JPEG file fragments from other sources, this resulted in a high level of false
positive classifications. If the identification classification had been JPEG imageonly
fragments from any source the false positive rate would have been
substantially lower. The same classification problem applies to PNG image-only
fragments where a substantial amount of the false positive fragments identified
were from other PNG files.
A decision was made in this research to use the observed subset of JPEG
markers found in visual thumbnails instead of the full set of valid markers.
Whilst this decision has improved the identification of H3 fragments for this
research and reduced the number of JPEG false positives it may not have the
Page
226