SLAMorris Final Thesis After Corrections.pdf - Cranfield University

same affect on other data sets. The alternative option would have been to
accept all markers which are defined as valid by the JPEG specification. It is
possible that whilst in the data sets collected by this research all JPEG visual
thumbnails conform to the marker list and positions documented in table 8.1,
other visual thumbnails may not; therefore this decision may exclude potential
evidence. However given the size of the data set it is also possible that the
visual thumbnails use a sub-set of markers as observed during this research.
Further research into visual thumbnail markers would be required to ascertain
whether the identification method should use the values observed during this
research or accept any marker which is valid in the specification.
The hybrid approach significantly improved identification and produced logs
which show the reasoning for accepting or rejecting each fragment. Neither the
methods in the comparative study nor the hybrid approach achieved high
classification rates for image-only fragments. Since image-only thumbnail cache
fragments have similar characteristics to standard image fragments it would be
difficult to completely remove false positive matches. Since the aim of this
research is to identify fragments which can be used for the reassembly research
in Chapter 9 then a requirement is to maximise the identification of thumbnail
cache file fragments whilst minimising false positives. Table 8.8 shows the
success and false positive rate of the hybrid approach.
This research highlights the improved identification of file fragment information
by understanding the structure of each fragment classification and by combining
methods. Unique characteristics identified for each classification may not be
unique when implemented and tested against a large data set; with the variety
of possible file fragment structures available it is likely that another file fragment
type would also have the same characteristic. By combining multiple
characteristics and methods for identification it is possible to reduce the number
of false positive identifications whilst maximising the identification of fragments
in the classification. The combination of approaches and breaking the
Page
227