SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Thumbnail caches contain metadata, such as the original files modification time,
location and name [Hurlbut, 2005]. This information is useful to corroborate
other metadata sources related to the file; this is particularly useful when only
fragments of the original file are available. The metadata and associated visual
thumbnail are not always removed from the cache when the original file is
deleted or moved. This can provide the analyst with information about the event
timeline for a file and can also be useful when producing evidence from deleted
files.
2.5 Conclusion
This chapter has analysed research related to this thesis; this began with an
overview of the field of Forensic Computing. The methodologies and tools used
in this field were examined along with current opportunities for research. It was
identified that artefacts in new operating systems such as the changes to the
thumbnail cache were of interest to analysts and therefore understanding their
structure and behaviour is an area for current research.
It was also noted that anti forensic techniques may be employed to remove
sources of potential information, therefore an area of current research would be
to identify and analyse any potentially useful fragments remaining on the
storage media. This Chapter examined data and information, focusing on how
information is stored and the forensic implications of metadata. It is important to
understand both the structure of the thumbnail cache and the storage media to
ensure an artefact is analysed in its original context.
Finally operating system thumbnail caches were discussed, it was highlighted
that whilst the general purpose of a thumbnail cache is defined each operating
system implements the construct in its own way. As well as the difference in
Page 38