SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Linux Category_4:
The last fragment in a Linux PNG thumbnail contains the IEND chunk. The end
of the IEND chunk is the last byte of the file; the file size should equal the file
size documented in the header of the file.
9.7.2 Linux thumbnail file fragment reassembly
As identified in Chapter 5, subrecords stored within the Gnome and KDE
thumbnail caches are stored in standard PNG format. The PNG format uses
data chunks which contain a data size, type and crc value; these provide useful
reassembly information by indicating both the expected structure of a fragment
and validation information. The hexadecimal output below shows a breakdown
of a thumbnail cache specific chunk found during the research conducted in
Chapter 5.
00000000 00 00 00 1874 45 58 7454 68 75 6D 62 3A 3A 49 ....tEXtThumb::I
00000010 6D 61 67 65 3A 3A 48 65 69 67 68 74 00 33 35 38 mage::Height.358
00000020 0F B9 03 29 .¹.)
Each chunk begins with a data size value; this indicates the complete size of
the chunk and therefore can be used to assist in identifying the number of bytes
in the chunk and specifically identifying the final byte of the chunk. This is
followed by an identifier, for the example above the identifier is ‘tEXt’, indicating
the chunk holds a string of data. The identifier provides syntactical information
to allow the chunk to be interpreted in an appropriate context. Finally each
chunk ends with 4 bytes which contain a 32 bit CRC value for the identifier and
data sections. The CRC value can also assist with validation, and is particularly
useful during reassembly if a chunk spans two or more fragments as it provides
a method for validation.
Page
259