SLAMorris Final Thesis After Corrections.pdf - Cranfield University

“Maximising corroboration can be defined as verifying and providing
additional information the artefact with other alternative sources of
information.” [Chapter 4.3.2]
Experiments were performed to identify the structure and behaviour of the
operating system thumbnail caches [Chapters 5 and 6] to ascertain whether
the artefacts occurred during the typical operation of the machine. The potential
user behaviour which led to an artefact’s current state was documented in
Sections 5.6 and 6.5; it was necessary to form relationships with other system
artefacts [Sections 5.7, 5.9, and 6.6]. These relationships provided
complementary and supplementary information relating to the thumbnail cache
artefacts and assisted in narrowing down potential user behaviour.
In order to identify the structure and behaviour of the operating system
thumbnail virtual drives were used to simulate potential user activity; these
drives were then analysed using forensic techniques [Sections 5.2, 6.2]. The
analysis method ensured that any changes between the baseline virtual
machine and the experiment data were analysed; this allowed relationships to
be formed between the thumbnail cache and system artefacts. Chapters 5 and
6 maximised the corroboration of the data by evaluating the potential
relationships with any altered system artefacts and the thumbnail cache; any
identified relationships were then documented.
The thumbnail cache artefacts retrieved from unallocated space can potentially
form relationships with the system artefacts identified in Sections 5.7, 5.9, and
6.6 which are present in the live file set. However neither the thumbnail cache
artefacts identified in unallocated space or the live thumbnail cache artefacts
can currently maximise corroboration or form relationships with other system
artefacts identified in unallocated space. The methodology used for the
extraction of thumbnail cache artefacts in unallocated space could potentially be
Page
272