SLAMorris Final Thesis After Corrections.pdf - Cranfield University

and 6. Each stage of the method has been shown to be justifiable earlier in this
subsection by providing logs which document the effect on the original data
therefore the process for the retrieval of thumbnail cache artefacts from
unallocated space has understandable consequences.
The process has a scientific method as it was created based on a hypothesis
[Section 1.4], based on the justification provided in Section 1.2. A problem
definition and objectives were described in Section 3.1; the methodology to test
the hypothesis using both observation of the data and experimentation was
provided in Section 3.3. Each individual section also contains a detailed
description of the specific methods used.
10.4 Typical Operation, Behaviour, Relationships and
Maximising Corroboration
“In order to determine an artefact was created during the typical operation of
a machine it is necessary to determine the system behaviour which led to an
artefacts current state.” [Chapter 4.3.2]
“In order to establish the behaviour an artefact represents it is necessary to
form relationships with other artefacts to identify potential system activity.”
[Chapter 4.3.2]
“A relationship between artefacts can be defined as an association between
artefacts; the relationship may provide corroboration or supplementary
information that enhances what is known about the system activity.”
[Chapter 4.3.2]
Page
271