SLAMorris Final Thesis After Corrections.pdf - Cranfield University

12 Conclusions and future work
12.1 Research Conclusions
This chapter provides a summary of the thesis by providing a description of the
contributions of this research, a description of possible future work and finally a
summary of the research performed and the conclusions resulting from this.
12.2 Contributions of Research
Throughout this thesis several contributions have been shown, this section
briefly describes each of those contributions. Firstly Chapter 4 has developed a
set of criteria for establishing the evidential value of artefacts from operating
system thumbnail caches. In Chapters 5 and 6 the structure and behaviour of 3
common thumbnail caches are described; until Morris [2011a] published a
paper based on the results of this research only selected part of the structure
and behaviour were documented in the public domain. Alongside understanding
the structure and behaviour of the thumbnail cache this research also showed
how relationships can be formed between the thumbnail cache and other
system artefacts; each relationship was evaluated to show its strength and
where possible the ways in which the relationship could be strengthened.
In Chapter 7, this research compared a selection of the most commonly used
file carving approaches and evaluated their performance against identifying
thumbnail cache file fragments. This enabled a critical evaluation of the
strengths and weaknesses of each file carving method and resulted in a new
approach based on a hybrid of the most common methods being developed for
the identification of thumbnail cache file fragments.
Page
291