SLAMorris Final Thesis After Corrections.pdf - Cranfield University

analysing the file type it is possible to concentrate on typical user behaviour
instead of the bias towards the known information; this could be followed up
with a set of experiments attempting to alter the known variables. A comparison
of the results from the initial user experiments and those achieved from the
second set of experimentation provide a wider insight into the file and potential
sources of further investigation.
This research has highlighted the importance of contextual analysis of digital
artefacts by showing the difference small variations in file structures and
differing methods of storing data relating to the same user interaction can have
on the artefacts found on a system. This research has provided documentation
on the structure and behaviour of thumbnail caches for digital analysts which
was not previously documented in a peer reviewed publication. Whilst the
research could have gone further into a study of the thumbs.db cache as this
research has shown it is still implemented in Windows 7 the complex OLE2
structure was felt to be too time consuming to attempt file fragment identification
on this type on top of the thumbnail caches already under investigation.
11.4 Thumbnail Cache File Fragment Identification
A significant contribution of this research was the comparative study of file
fragment identification techniques which led to the creation of a hybrid
technique which improved the identification of thumbnail cache file fragments. It
was necessary to adapt existing techniques to identify single file fragments. If a
single method had been created for the identification the criteria for maximising
the data may not have been met; by using the strengths of individual methods it
was possible to maximise the identification of fragments in each classification.
Whilst several common file fragment identification techniques were compared
time and resource constraints did not permit the evaluation of every available
Page
282