SLAMorris Final Thesis After Corrections.pdf - Cranfield University

chapter evaluates possible image fragment identification methods; this research
enables an approach to be created to improve the accuracy of identifying
potential image-only thumbnail cache file fragments. The aim of this chapter is
to maximise the number of file fragments available for the reassembly process;
this led to a substantial number of standard image fragments being falsely
identified as thumbnail cache fragments. It was determined that having a large
number of false positives for the image category was preferable as it makes
successful reassembly more likely.
Chapter 9 describes the research conducted into methods of reassembling the
thumbnail cache file fragments identified in Chapters 7 and 8. A general
reassembly model was constructed based upon the methodology for
reassembling a jigsaw puzzle. Each file type used in the thumbnail caches’
examined in Chapters 5 and 6 was then separately considered to assist with
the reassembly and validation of the file fragment sequences produced. This
Chapter concludes with a description of the artefacts identified from data set 3
which contained data taken from unallocated space using the implemented
identification and reassembly approaches.
Chapter 10 evaluates the evidential value of both complete and deleted
fragments of operating system thumbnail caches. The evidential value of the
thumbnail caches identified in Chapters 5 and 6, as well as the fragments
recovered and reassembled at the end of Chapter 9, are evaluated against the
criteria set in Chapter 4. This chapter highlights the fact that some artefacts,
such as thumbnail caches from previous windows installations, can only be
recovered from unallocated space. It also highlights the increased evidential
value of using complete and deleted fragments of thumbnail caches together to
increase understanding of the system’s activity.
Page 8