SLAMorris Final Thesis After Corrections.pdf - Cranfield University

creation of a file fragment reassembly method. The general reassembly
approach is documented in Section 9.3.5. Throughout this thesis the
importance of understanding the structure and valid syntax of a file type have
been highlighted. The information about the file type can be used to validate the
reassembly of the individual files and assist with customising the reassembly
process for each file type.
In order to complete this research a general approach to file fragment
reassembly will be used; this approach will be customised by each individual file
type to enable the selection and validation of file fragments at each point in the
reassembly of a file. This section describes the general method for file fragment
reassembly and discusses the considerations for customisation. A description
of the methods for training and testing, and the data sets used for evaluating the
reassembly methods are also provided.
9.3.1 Potential clashes and missing fragments
For each file type reassembly there are two important individual considerations:
dealing with potential clashes for a reassembly point, and dealing with missing
fragments. If no suitable fragment can be found for a point in the reassembly
this research will place an empty fragment in its place; in order to ensure an
analyst may easily identify the substitute fragment it will contain the ASCII
phrase “SUBSITUTE” repeated through the fragment. As shown in figure 9.1,
after the reassembly process has gone through each point of the file it tries to
resolve any points where a clash has occurred. A clash occurs where multiple
fragments appear to fulfil the requirements for reassembly at a point in the file;
once the remainder of the file has been reassembled it may be possible to
identify which of the clashing fragments belongs to the file. The method for
determining which clashing fragment to select is individual to each file type; the
method requires an understanding of the characteristics of each file type to
ascertain which fragment is the most likely to belong to the file.
Page
234