SLAMorris Final Thesis After Corrections.pdf - Cranfield University

As discussed in the previous section the log files produced at each stage of the
process provide sufficient information to show how the results were obtained
and their relationship to the original data. For the identification methods each
log documents the reason a fragment was put in a particular classification
[Sections 7.9, 8.2]; by documenting the reason for each classification it is
possible to determine how the results were obtained. The logs also show the
original location of a fragment which permits an analyst to find a fragment in the
original data and analyse it in the context of the complete set of data.
For the reassembly methods a similar log is used [Section 9.3] to provide
documentation for the reassembly process. The log provides a breakdown of
the reassembled files and the reason for the position of each reassembled
fragment; therefore it an analyst is shown how the results were obtained and
how they relate to the original input data. The extraction of artefacts from the
reassembled thumbnail caches is achieved by using the structures identified in
Chapters 5 and 6 which are documented in Appendix A. The extraction
software displays each extracted artefact with a breakdown of the structure that
was applied to interpret the data, details of the original location, and links to
other related artefacts [Section 9.10].
In order to extract thumbnail cache artefacts from unallocated space the method
created for this research was broken down into stages. Firstly the method
classifies fragments into types [Chapters 7 and 8]; this allows the removal of
fragments which are unlikely to belong to thumbnail cache files. Once the
fragments are classified the thumbnail cache files are reassembled from the
identified fragments [Chapter 9]; at this stage all identified fragments which
could not be reassembled are stored for potential hand analysis at a later stage
[Section 9.10]. Thumbnail cache artefacts are then extracted from the
reassembled files using the structures and syntaxes identified in Chapters 5
Page
270