SLAMorris Final Thesis After Corrections.pdf - Cranfield University

2 Related Research
2.1 Introduction
This chapter identifies potential opportunities for research within forensic
computing; it also reviews literature relating to the evaluation of the evidential
value of thumbnail cache file fragments in unallocated space. Research relating
to data carving and reassembly are discussed in Chapters 7,8 and 9.In this
Chapter, Section 2.2 defines the term forensic computing, and describes the
field’s development; this leads on to a description of the methodologies used
within the field. The section concludes with an overview of current opportunities
within the field.
Section 2.3 looks at data and information, starting with how information is
stored; this is followed by a review of metadata and its importance in Forensic
Computing. Section 2.4 looks specifically at the thumbnail cache, discussing
how thumbnails are used within computing and why they are useful. This is
followed by a more detailed examination of five common operating system
thumbnail caches and a summary of their forensic significance.
2.2 Forensic Computing
Forensic computing is thought to have originated in the late 1980s [Hannan,
2004], research and development in the field is generally driven by market
requirements [Noblett, 2000]. This is partially due to the rapid growth of
technology throughout society and the limited resources available for analysts
to perform investigations; therefore research is generally conducted to enable
the analysis and understanding of current casework.
Page 11