SLAMorris Final Thesis After Corrections.pdf - Cranfield University

processing time of the reassembly method. For this research the identified
information maximised the data retrieved and provided information which
assisted in proving the research hypothesis.
In Chapter 8 the research considered the characteristics of JPEG file
fragments, both from the thumbnail cache and other sources. The research
considered JPEG start of sequence markers; table 8.1 lists the 8 sequence
markers found in the visual thumbnails tested. As all 8 sequence markers
occurred in every JPEG thumbnail cache image tested a decision was made to
exclude fragments which contained any other sequence starting with 0xFF. This
meant that other sequences, which were valid markers in the JPEG
specification, would have resulted in a fragment being rejected. Given the
number of thumbnails tested it is possible that the 8 markers are the only ones
which occur in visual thumbnails; however it is also possible that thumbnail
caches outside the test data may contain other sequences.
The use of observed characteristics instead of the specification made it possible
to significantly reduce the number of false positive JPEG identifications; this led
to a smaller number of fragments for the reassembly method. The reduction in
false positives improved the performance and feasibility of the reassembly
approach. If JPEG visual thumbnails exist which contain other sequence
markers they will not be identified; therefore this may significantly impact the
artefacts available for an analyst to present in his report. Further work is
required to explore the characteristics of JPEG and JPEG thumbnail cache file
fragments to assist with distinguishing between them for file fragment
identification and reassembly.
Page
286