SLAMorris Final Thesis After Corrections.pdf - Cranfield University

activity. All the non-standard subrecords were recovered providing a variety of
information about icons, network places and drive allocations.
The thumbnail caches recovered show that it is possible to recover fragments
from previous thumbnail caches on the system. The caches may be from
previously installed operating systems, deleted user accounts or from thumbnail
caches deleted by the system or user to enhance system performance or
privacy. Whilst the range of thumbnail caches is wide it is difficult to determine
where the thumbnail cache was originally from. However using the live file set it
is possible to determine earlier versions of the current thumbnail cache.
For the Linux thumbnail cache PNG visual thumbnails all identified fragments
were successfully reassembled however they required a significant amount of
processing time. The visual thumbnails provide the same range of information
as those detailed in Chapter 5. The visual thumbnails which contain the URI
assist in forming a relationship with individual source files; the visual thumbnails
can also be used to form relationships with the system. As with the Windows
thumbnail cache it is not possible to determine whether the thumbnails come
from the current or a previous installation of an operating system. It is also
difficult to determine the user account. Information such as who had permission
to access a URI stored in a visual thumbnail can assist with forming further
relationships between the information in unallocated space and the live file set.
9.10 Discussion
Each of the reassembly methods implemented during this research used
knowledge of the structure and syntax of the file types; the general method
provided a structure for the reassembly which was supplemented by providing
information on the unique characteristics of each file type. Whilst other
reassembly methods could have been selected the use of file characteristics
Page
263