SLAMorris Final Thesis After Corrections.pdf - Cranfield University

information about hiding your actions. This growth of understanding makes it
more likely that a user wishing to hide information relating to their activities may
seek to remove sources of potential artefacts such as the thumbnail cache. If
the thumbnail cache is deleted it can still be found in unallocated space;
potentially fragments of the thumbnail cache may exist in unallocated space for
a significant time after deletion. Whilst the evidential value of fragments of data
recovered from unallocated space may be less than a complete file the
fragments have the potential to provide information that is not available in the
live file set and which may provide vital information to prove or disprove a
hypothesis.
This research has shown that the ability to understand a file format can improve
the ability to construct methods for the identification and reassembly of file
fragments. This was highlighted by the creation of proof of concept software
which implemented a hybrid identification approach which was refined using
structural and syntactical knowledge about the file identified during this
research. Further support for the importance of understanding a file type came
from the use of this information in producing specific reassembly methods; each
method relied upon unique file characteristics to reassemble the files as
accurately as possible.
This research has shown the structure and behaviour of common operating
system thumbnail caches and highlighted the importance of contextual analysis
of an artefact in order to fully understand the user and system behaviour it
represents. The methodologies produced for the identification and reassembly
of thumbnail cache file types showed that there are some forms of information
which may only be retrieved from unallocated space. Whilst a complete
thumbnail cache in a live file set gives an analyst the opportunity to develop
relationships and construct a detailed contextual analysis of the systems
behaviour deleted thumbnail cache artefacts may also assist in an analysis. For
example thumbnail caches in unallocated space may belong to previous
Page
294