SLAMorris Final Thesis After Corrections.pdf - Cranfield University

eassembly is more likely when there are too many fragments rather than too
few. It should also be noted that the larger the number of fragments in a data
set the more resources that will be required to complete the reassembly.
This chapter is structured as follows: firstly previous research into file fragment
reassembly is considered in Section 9.2. The methodology for this research is
presented in Section 9.3; the method for reassembling the thumbcache_idx
files is described in Section 9.4. The method for reassembling thumbcache_32,
thumbcache_96, and thumbcache_1024 files is described in Section 9.5. In
Section 9.6 the thumbcache_256 reassembly method is described; this is
followed by the reassembly method for Linux thumbnail cache files in Section
9.7. The results of the implemented reassembly methods are provided in
Section 9.8; Section 9.9 provides a description of the information from
thumbnail cache files reassembled from Data Set 3 of Chapter 7. A discussion
of this research is provided in Section 9.10; the chapter conclusion is in
Section 9.11.
9.2 Image Reassembly
In Chapters 7 and 8 a significant proportion of the previous research reviewed
used methods for file identification that combined the identification and
reassembly process; the methods combining the steps tended to focus on
single file types with unique characteristics and without a compound structure.
The combined identification and reassembly approach tended to focus on the
reassembled files having a valid structure or valid result after processing the
data. In this research the identification and reassembly research have been
conducted separately; this permitted the identification of single file fragments
where the rest of the fragments of the file were no longer available.
Page
232