SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Identify existing file carving techniques
File carving as described in Chapter 7 is the process of extracting a set
of data which meet specific criteria from unallocated space. In order to
recover thumbnail cache file fragments it will be necessary to implement
a file carver; identifying existing techniques will provide a starting point
for the recovery of thumbnail cache files.
Evaluate the results of existing file carving techniques on
identifying and reassembling thumbnail cache file fragments
If a single file carving method was used to retrieve thumbnail cache file
fragments and the results were used to establish the evidential value, the
method may impact the results. By implementing a variety of existing
techniques the results can be compared in order to maximise the
recovery of file fragments.
Develop an approach to improve the ability to identify and
reassemble thumbnail cache file fragments in unallocated space
In addition to comparing the results of existing methods any resulting
research gaps will be explored by attempting to improve the accuracy of
file carving the fragments should it be necessary.
Extract and reassemble thumbnail cache file fragments using the
developed method
The research hypothesis focuses on file fragments, the file fragments
require identification which will result in classification. Attempting to
reassemble the various fragments into their original files will assist in
providing context to individual artefacts.
Evaluate evidential value of thumbnail cache file fragments
identified in unallocated space
Page 42