SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Table 8.2 shows the improved accuracy of image-only JPEG fragment
recognition with an improved result of 75.5% of this category being correctly
classified. The hybrid approach took the most successful method for each
classification from Chapter 7 and continued to develop the approach into a
single identification method [Chapter 8]. Finally for the reassembly methods,
Section 9.8 shows the results of reassembly with the lowest result for data set
2 for the thumbcache_96 file with 81.26% of available fragments correctly
reassembled; the result was due to the high number of clashes on image-only
fragments. The thumbcache_idx file was reassembled with 100% accuracy.
10.6 Automation
“Automation is defined as a scientific process which has been implemented
to minimise the interaction of an analyst.” [Chapter 4.3.2]
This process has been shown to automate the identification and reassembly of
thumbnail cache file fragments by implementing a selection of methods
documented in Chapters 7, 8, and 9. The extraction of thumbnail cache
artefacts is also automated and documented in Section 9.10. As the previous
section showed both the identification and reassembly stages of this
methodology have failed to maximise the data available [Sections 7.10, 8.7,
and 9.8]; therefore the resulting reassembled files may not be completed and
may require further work by an analyst to identify any missing fragments should
they exist. In the case of a potential clash of fragments for a position in a file
during reassembly an analyst would have to perform further verification by
hand. The extensive log files would assist an analyst by documenting the
reasoning for each potential fragment and providing the original locations of the
fragments; the original locations allow an analyst to place the pieces in context.
Page
274