SLAMorris Final Thesis After Corrections.pdf - Cranfield University

adapted to extract artefact from other file types and therefore extract potentially
maximise corroborating information.
10.5 Maximum Amount of Data
“The maximum amount of data retrieved is defined as the identification and
reassembly of all thumbnail cache file fragments used during the research.”
[Chapter 4.3.2]
Fragment recovery is attempted to maximise the data available to an analyst;
the information recovered may provide additional information relating to the
investigation. In order to establish if the maximum amount of data was retrieved
using this method each file fragment in the corpus contained a header which
provided information about the actual classification of the file fragment and its
original location on a disk [Section 7.3]. The use of a controlled corpus allowed
the results at each stage of the process to be monitored and compared to the
original data.
For the identification methods the results in Section 7.10 show the identification
of each fragment classification; the results identify the actual number of
fragments in a classification and provide a breakdown of where the fragments
were classified using the method. As can be seen from the results of method 5
100% of the file fragments in classifications H1 and H2 were correctly identified
with no false positive identifications in these categories. Of the remaining
classifications the lowest achieved accuracy was 66.84% for H3; this category
had a substantial amount of false positives.
Page
273