SLAMorris Final Thesis After Corrections.pdf - Cranfield University

In Chapter 9.5 a decision was taken to present the analyst with all valid image
reconstructions. The file system information relating to fragments in unallocated
space may not be available; this can make forming relationships between
fragments difficult. There may be multiple versions of the thumbnail cache and
subrecords relating to individual files which may lead to a file fragment
reassembly which appears valid but was not an actual file on the device. This
led to the decision to present the analyst with all valid image reconstructions;
allowing the analyst to review the logs showing the reasoning which led to each
reconstructed images. The analyst can then verify the information and make
their own decision about what artefacts to present in their report.
11.8 Conclusion
In conclusion, this research has taken a large research question and logically
broken it down into smaller research goals with the aim of supporting or
disproving the central hypothesis. This has been achieved by creating a set of
criteria in order to evaluate the evidential value of thumbnail cache artefacts; the
criteria were developed by evaluating the potential constraints on digital
evidence and applying this information to the thumbnail cache. The
development of the criteria before performing further investigation ensured that
the criteria were independent of the results of this research. This research has
described both the structure and behaviour of several popular implementations
of the thumbnail cache; this research could have been improved by further
investigation into the thumbs.db format.
This research compared a variety of commonly implemented file fragment
identification techniques; identification methods independently attempted to
identify file fragments based solely on their content. Reassembly methods were
based on the structural and behavioural research performed as this was
deemed the most suitable method for Forensic Computing. Further research
Page
288