SLAMorris Final Thesis After Corrections.pdf - Cranfield University

makes them difficult to identify, and can affect the reliability of information being
read or written to the storage media, making it corrupt.
Both users and IT professionals are often unaware of the information being
stored on a hard disk. Joukov [2006], discusses common misconceptions; for
example, most users believe simply deleting a file removes it, when in fact the
file is still retrievable. Explaining misconceptions to uses improves their
understanding and may directly influence the precautions they take to secure
their data. Secure overwrite systems are often used to ensure files are deleted
adequately; fortunately for forensic analysts, these systems generally neglect
metadata that is not stored with the file.
When deleting files, temporary files are often overlooked; these files may
contain as much sensitive information as the files the user is deleting
[Zetterstrom, 2002]. It is suggested that to ensure sensitive information is not
recoverable the best options are to sand the disks in the hard drive or put it in
acid, whilst these may seem drastic it is likely they would completely destroy the
original file system [NIST, 2013]. Various tools are available to corrupt
information, and although they may not be as comprehensive they would
remove a significant portion of the information.
2.4 Thumbnails and the Thumbnail Cache
A Visual thumbnail can be defined as a small graphical representation of a
larger object [Microsoft, 2002]; a thumbnail cache is generally considered to be
a collection of these images stored with associated metadata. The primary
purpose of the thumbnail cache is to prevent the rendering of a new version of a
thumbnail unless the source object has altered. This section discusses the
applications of visual thumbnails within computing and the benefits of using a
cache to store the images. This is followed by an overview of the way the
Page 32