SLAMorris Final Thesis After Corrections.pdf - Cranfield University

IDX Category_3: Fragment with 127 complete records and no file header
In this case the fragment begins with 24 bytes of a record and finishes with the
first 8 bytes of a record; in between these two partial records are 127 complete
records which can be used to identify the potential size of the hash table that
the fragment relates to. The complete records can also be used to identify the
position of the fragment within the hash table by working out the relative
position of the fragment for each valid hash table size. In order to establish a
valid hash table size multiple records can be used to corroborate the validity of
using the possible size in the formula for calculating relative positions; the
formula for validating the thumbcache ID described in Chapter 6 can be used to
find a list of table sizes which would be valid for the fragment. This can be
achieved by finding a common table size which produces valid sequential
record numbers for the fragment.
IDX Category_4: Fragment with less than 127 complete records and no file
header
In this case the records which are in use will not reach the end of the fragment
and whilst it is likely there will be at least one in use record present the fragment
may be completely empty. Therefore any records present will be used in the
same way as in Category_3 to determine the potential hash table size. Once
this fragment has been added to the file reassembly chain, it is possible to
calculate the number of in use records and check this matches what was
expected.
9.4.2 Thumbcache_idx file fragment reassembly
In order to reassemble the index file fragments each fragment in the H1 subdirectory
is evaluated; the fragments are separated into those which start with
the index file signature and those which do not. In order to minimise the
Page
242