SLAMorris Final Thesis After Corrections.pdf - Cranfield University

investigation is necessary to establish whether the audio thumbnails leave any
forensic artefacts on the system. With Nautilus implementing a separate folder
to store thumbnails in standard image formats, carving for visual thumbnails in
slack space is a standard image carving problem, with the carving and
reassembly of any metadata or audio thumbnail fragments being a separate
problem.
OS X can display files in a thumbnail view, however this is not on by default,
and little documentation exists about how it is implemented. When the user
selects to view thumbnail size images, they can choose the size of the image,
therefore the forensic value of these images will vary depending on the size
selection.
2.4.3 Forensic significance
Whilst the function of a thumbnail cache has been defined, the interpretation of
the structure varies considerably between implementations. This means that
each thumbnail cache structure will have a different forensic value and the data
stored within it may not represent the same series of events. The images stored
within the thumbnail cache are forensically useful in the analysis of a wide
variety of crimes, as each image can represent a wide variety of file types and
information.
For cases involving illicit images it can be necessary to show the authenticity of
an image [Kornblum, 2008]; to establish whether it is a genuine unaltered
photograph. If an image has been altered, and the quality of that section is
lower than the remainder of the photograph it is possible to identify significant
differences in the wavelet statistics [Lyu, 2005]. Given the quality of editing
software currently available, the difference in quality of manipulated areas of
photographs may not be significant enough to use this methodology in the
Page 36