SLAMorris Final Thesis After Corrections.pdf - Cranfield University

2007], which assist in building event timelines as they elaborate on the
relationships between MAC times. They can also elaborate on the user and
system behaviour effects on the file’s state. Chow reviews the value of the
thumbnail cache, in relation to these rules, for establishing information relating
to the viewing of such files [Chow, 2007: Scenario 9]. This suggests that the
thumbnail cache can be used to assist in building timelines of activity on a
machine. MAC times are sensitive to manipulation [Waghorn, 2003] and require
careful consideration by analysts to ensure they maintain their validity, not just
because of accidental clicking on a file, but ensuring there are no traces of
programs specifically designed to alter MAC times, and that the BIOS time is
set as expected.
2.3.3 Event Reconstruction
Digital investigations use the same five key phases as those used in traditional
physical investigations; preservation, surveying, documenting, searching,
reconstruction [Carrier, 2005]. Reconstruction in digital investigations involves
analysing the information recovered from a system and constructing events
from it; the events can be ordered to show how the information recovered came
to exist in its present state. An event can be defined as an incident that changes
the state of one or more objects; in a digital investigation, an event can be
thought of as an action that changes one or more of the bits in which the
information is stored.
In a case, event reconstruction can assist in proving or disproving guilt by
establishing the order in which events occurred. Once events have been
reconstructed, characteristics can be used to determine whether the actions
were committed with intent [Carney, 2004]. For example, analysing times can
give an indication of whether an action was the result of a piece of software or
the user, since the user will have slower reaction times than the machine; there
would need to be larger gaps between events than a machine would require.
Page 27