SLAMorris Final Thesis After Corrections.pdf - Cranfield University

“Clear documentation is defined as something which another analyst could
read, understand and use to repeat the described processes.” [Chapter
4.3.1]
The identification methods implemented were documented in Chapter 7, and
the image fragment identification was further discussed in Chapter 8; an
analyst could use the documentation to replicate the experiments. If necessary,
an analyst could confirm the research results by replicating the experiments;
however it may be difficult for a typical analyst to implement both the statistical
and neural network identification methods described in Chapter 7. In Section
2.2.2 the use of dual tool verification was discussed; if a second tool or an
analyst working by hand could independently achieve the same result then this
could be used for corroboration. Each implemented method provides a log
which contains: the classification of each fragment, the original position of the
fragment on the disk, and the reason for the classification [Section 7.9]. The log
provides sufficient information about individual fragments to allow an analyst to
corroborate the classification by hand or with a second tool; therefore the logs
can be used to understand the process and corroborate the results.
The reassembly methods implemented in Chapter 9 also provide logs which
contain: the original location of the fragment, its position in the reassembled file,
and the reason for its current reassembled position. This information can be
used by an analyst to identify the fragments of a reassembled file by hand on
the original disk and follow the information provided in the log to verify the
reassembled file [Section 9.3]. The reassembly methods described in Chapter
9 are based on structural and syntactical properties of the individual file types;
an analyst could use the information provided to replicate the method and
corroborate the results.
Page
268