SLAMorris Final Thesis After Corrections.pdf - Cranfield University

implementations of operating system thumbnail caches and discusses available
literature on their implementations.
Chapter 3 highlights the requirement to breakdown the aim of this research into
smaller focused areas in order to determine the validity of the hypothesis; the
objectives of the components of this research are described. This is followed by
an overview of the potential considerations for this research. One of the most
significant considerations for this research is the requirement to evaluate
methodologies and results by appropriate forensic standards. Finally, the
software tools used during this research are described.
Chapter 4 identifies the criteria which determine the evidential value of an
artefact and establishes how the criteria can be applied to evidence relating to a
thumbnail cache. This chapter explores the term evidence and evaluates how
evidential value is assessed in court; the criteria established for assessing
evidential value in general are then applied specifically to the thumbnail cache
to create a specification which can be used to evaluate the results of this
research.
Chapter 5 describes the structure and behaviour of the thumbnail cache
implementations used in the Linux distributions Ubuntu and Kubuntu. The
structural study highlights that whilst both thumbnail caches were implemented
based on the same open desktop specification there are in fact small but
important differences. The behavioural study identifies common user
interactions with the system that would result in changes to data within the
thumbnail cache; it also describes the changes that occur on the remainder of
the system. The changes to the data can be used to identify possible user
activity which has occurred on the system.
Page 6