SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Kerr [2006] identified that an analyst will require a significantly longer time to
analyse a computer than the user would have taken to carry out the actions
under investigation. This means that with the increasing size of storage media
significant resources are required to carry out a thorough examination.
However, increasing the number of analysts used during investigations is
unlikely to be effective. Improving the methodology currently being employed by
standardising analysis techniques will enable the use of available resources to
be maximised. The use of resources could be maximised if analysis techniques
were standardised by developing techniques which make the most efficient use
of computer and personnel time; however it could be argued that each
individual forensic team is likely to develop approaches which maximise their
personal set of resources. The development of analysis techniques is also likely
to improve the results of analysis by ensuring a methodical approach is adopted
instead of each analyst analysing a machine in their own way.
NTFS file compression may provide problems for analysts as not all tools
employed can retrieve information stored in this way [Sanderson, 2006]. A file
compressed in this way can be composed of both compressed and
uncompressed sections, making it difficult to interpret when the Master File
Table (MFT) is not available. Generally documents like those produced in Word
are highly likely to be compressed whereas JPEGs are unlikely to be
compressed in this method, due to the high rate of compression already
employed in that format. Interestingly if a document is compressed using NTFS
compression when it is deleted, then it will remain in this state after deletion
[Sanderson, 2006]; this suggests such compression techniques must be taken
into consideration when carving files, especially when no MFT information is
available.
Page 24