SLAMorris Final Thesis After Corrections.pdf - Cranfield University

9.7.1 Linux thumbnail file fragment categories
Linux thumbnails are stored over several fragments; in Chapter 7 generally half
the fragments of each individual file contain metadata. In Section 9.3 it was
determined that this research uses four categories of file fragment for
reassembly. The categories are described below:
Linux Category_1:
This category represents a fragment which is a self-contained file. Given the
structure of the PNG format the chance of a thumbnail cache image in the
format which is less than 4096 bytes is small. If a fragment fits into this category
the file size would be less than or equal to the fragment size; the fragment
would also contain complete chunks which had valid CRC values.
Linux Category_2:
This category represents the first fragment in a larger PNG Linux thumbnail
cache file; the fragment starts with a PNG header and may contain thumbnail
cache specific metadata chunks. The PNG header contains the expected size
of the image, and each chunk also contains an expected size. It is likely the
fragment will end part way through a chunk; in this case fragments can be found
which match with the expected size of the fragment.
Linux Category_3:
This category represents fragments which are in the middle of a file; these
fragments may either contain metadata or be image-only. On analysis of the
training file it was found that the only metadata present in the middle fragments
of PNG thumbnail images was the IDAT chunk identifier. This identifier would
be preceded by the CRC value for the previous chunk and the expected size of
the IDAT chunk.
Page
258