SLAMorris Final Thesis After Corrections.pdf - Cranfield University

An important question for each artefact an analyst identifies is its position within
the file system structure; he must identify the storage structure of the devices.
For example thumbs.db files can be found throughout a Windows XP operating
system and in order to establish the meaning of a particular instance of the
cache it is necessary to establish its relative location [Hurlbut, 2005]. This is
forensically significant as it provides an understanding of where any evidence
came from in relation to the rest of the information being stored. It is equally
important to clarify where a deleted file was in relation to other files on the disk.
However, this can be difficult for an analyst when the folder containing the
deleted file is no longer on the disk; in this case the file is known as an orphan.
Hurlbut investigates methods of identifying this particular class of deleted files
with relative success. For a visual thumbnail it is important to establish a
relationship to the original file the image it relates to; this can provide important
information about the original file, such as the file path or associated dates and
times.
It would not be an effective use of resources to examine every piece of stored
information in every investigation; therefore it is necessary to reduce the
amount of information to be analysed. Whilst this ensures value is obtained
from the resources it may also lead to some important information being missed
[Hama, 1996]. Hama suggested one method of refining the information is to
ignore anything that is unlikely to be relevant to an investigation; for example,
standard libraries or images that come with the operating system or commercial
applications. Whilst this does reduce the number of files for consideration, care
must be taken to ensure that files which are discounted as a result of such preprocessing
have not been altered by a criminal aware of such procedures. Files
can also be discarded on the basis of their extensions; however any method
would need to check that the header and contents of the file match the
extension. Any unused space on the storage media would need searching for
deleted or partial files. Finally string searches can be useful in locating
information, but the results can vary significantly based upon the keyword used.
Page 23