SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Store Category_4: Fragment is at the end of the file
The thumbnail cache files pre-allocate space, which they then fill with
subrecords; once the file is full a new larger file is created, which can then be
populated with the existing data giving the thumbnail cache room to continue
growing. The last subrecord marker in the file contains an empty record; the
empty record continues to the end of the file. The empty subrecord may contain
non-thumbnail cache data in its data section; therefore there may be fragments
which are part of the thumbnail cache file but do not contain thumbnail cache
file data.
As it is not possible to know the contents, or structure of the last subrecord’s
data section, this research focuses on the reassembly of the files until the last
subrecord is identified; the research does not aim to reassemble the data
section of the last subrecord. The last subrecord header is identifiable: it begins
with the header “CMMM”, four bytes indicating the size of the subrecord, 32
bytes of 0x00, followed by the thumbnail cache ID value. The 32 empty bytes
show this is the last subrecord and therefore all complete subrecords are above
this point in the file. By identifying the fragment, where the last “CMMM” occurs
at the expected relative offset given the size of the preceding chunk, the
reassembly has reached the end of the file.
9.5.2 Thumbcache_32, 96, 1024 file fragment reassembly
Both category 1 and 2 represent the first fragment in a file; both categories
represent a fragment which starts with the file signature “CMMM”. As the file
signature is also used as a subrecord signature it is possible that if a subrecord
started on a fragment boundary it may be confused for the start of a file. To
ensure a valid category 1 or 2 fragment is identified the remainder of the file
header is validated against the expected structure described in Chapter 6.
Page
248