SLAMorris Final Thesis After Corrections.pdf - Cranfield University

available for office documents; therefore users may still create files using the
original OLE2 structure. It is likely that any identification of thumbs.db fragments
will have similarities with those from office documents making them a likely
source of false positives, however it may be possible to generalise the methods
used for identification to include these structures.
Vista introduced a new thumbnail cache format, which centralised the holding of
thumbnails for each user. This centralised cache consists of six files; each
object has a record in the index file which has references for up to four different
sized thumbnails of the object, each stored in a file for their size range, the
purpose of the sixth file is not yet known. The four image files hold thumbnails
which are up to 32 x 32, 96 x 96, 256 x 256 and 1024 x 1024 pixels in size. The
introduction of larger thumbnails provides the opportunity for a more detailed
image, which can show readable text, enhancing their forensic value. To show a
relationship between the original object and an entry in the thumbnail cache it is
necessary to establish the path where the object resided when the entry was
created or modified. The path information is not stored in the cache itself, but
the windows.edb file [Douglas, 2009], whilst the remainder of the metadata is
located in the cache. Windows 7 uses the same centralised six file thumbnail
cache format as Windows Vista, but as yet it is unclear if the structure, its
interaction with the rest of the operating system, and the resulting forensic
artefacts, will be the same.
Ubuntu 10.10 uses Nautilus for file management, thumbnails are stored as
images in a centralised folder, and thumbnails can be stored for a variety of
image formats and PDF files [Ubuntu, 2010]. Open Office [2012] created a
script which allows thumbnails for open office documents to be created and
stored, increasing the variety of images found in the thumbnail cache. A unique
feature of Nautilus’ thumbnail implementation is the creation of audio
thumbnails; putting your mouse on an audio file will result in the file playing,
allowing the user to browse in a similar way to image formats. Further
Page 35