SLAMorris Final Thesis After Corrections.pdf - Cranfield University

9.4.1 Thumbcache_idx file fragment categories
The repeating and fixed size record structure of the thumbcache_idx.db file can
assist with reassembling the various fragments of the file. The index file stores
records in a hash table whose size is always a multiple of 101; each file
fragment of 4096 bytes can hold up to 127 complete records as shown in figure
9.2. The figure shows there are four different categories of this file fragment
type. Below each category is described:
IDX Category_1: Fragment with 101 records and file header
In this case the single fragment contains the entire 101 record index and
therefore does not require further reassembly. The first check to identify these
fragments is to check the file header identifier “IMMM”; this is followed by
checking the header structure is a valid thumbcache_idx structure as identified
in Appendix A. Within the header the number of records should be set to 101, if
the number is larger, then the fragment belongs to Category_2. As a 4096 byte
fragment can contain up to 127 complete records a further check is made to
ensure that the fragment is empty after the 101 expected records; therefore the
last 840 bytes of the fragment is checked to ensure they are0x00.If a fragment
meets the criteria for this category it is logged as a reassembled file. As the
entire 101 record file has been recovered the file is complete and the method
moves on to the next fragment for identification.
IDX Category_2: Fragment with 127 complete records and file header
This fragment is the beginning of a larger index file which is stored over multiple
fragments. The checks performed for this category are the same as in
category_1; the difference between the two categories is the total number of
records stored in the complete file. The file header contains the size of the index
hash table and it is therefore possible to work out the total number of file
fragments storing the index file; each fragment can hold up to 127 complete
Page
240