SLAMorris Final Thesis After Corrections.pdf - Cranfield University

future. It is possible to establish the creation method of an image based on the
noise and colour interpolation coefficients within it [McKay, 2008]; in the
thumbnail cache this could provide validation that a thumbnail was created
using the appropriate method for that cache and has not been manipulated or
planted.
In Windows XP, the thumbnail cache files are only created when a user views a
directory in windows explorer and views the files in filmstrip or thumbnail mode
[Hurlbut, 2005]. Therefore the existence of a Thumbs.db file suggests that the
file was present in a directory which at some point was viewed in thumbnail
mode. Mercuri [2010] described a situation where the Thumbs.db could have
originated in a directory on a different machine which at an earlier point in time
contained images which were added to the Thumbs.db file. The directory if
copied to another computer would potentially copy across the Thumbs.db file
which would still contain records relating to the images. The images in question
were not on the current computer and the user may have no knowledge of their
original existence. Mercuri’s example is taken from her defence work on the
case of Vosburgh [Mercuri, 2010], and highlights the importance of establishing
the context for the images contained within the thumbnail cache.
Further research is required to establish the situations where other operating
systems cache images and to find out if there is a relationship between viewing
a file and its addition to the cache. Where thumbnail caches are created in the
relevant directory they may be found on external or networked media; this can
be used as supporting evidence that the media was used in collaboration with
the machine and viewed by a user. Where the thumbnail cache is centralised,
the existence of entries for external or networked media can also assist the
analyst, particularly in cases where the media itself is damaged or cannot be
located as it would provide information on the contents of the media and show it
had at some time been connected to that machine.
Page 37