SLAMorris Final Thesis After Corrections.pdf - Cranfield University

throughout this research. Within this research it has been decided that the focus
will be on artefacts most likely to assist in an investigation; the methodologies
created can then be generalised to other less frequently observed artefacts.
3.4 Tools
Throughout this research the most commonly used tool will be a virtual
machine, specifically VMWare Workstation version 7 [2011]; the virtual
machines will originally be created as part of the structural and behavioural
studies and will then be used as file fragments for the identification and
reassembly research. The use of a virtual machine will enable a clean baseline
of each operating system to be created which can be specifically manipulated
for each individual experiment. The results of each experiment can then be
compared with the original baseline virtual machine to identify the differences.
The use of flat virtual hard disks means the hard disk was equivalent to a
standard uncompressed hard drive image and can therefore be examined using
tools and methodologies that would be used during a typical analysis.
Procmon [Microsoft, 2012b] will be used during the experiments in Windows
systems to log the processes being called; the logs will be stored in CSV format
and the results will be examined in Procmon and Excel to identify potentially
interesting processes. Procmon results may provide significant insight into the
processes being called when thumbnails were being created and displayed.
A hexadecimal editor called Winhex [Fleishmamn, 2008] will be the primary tool
used in the examination of the virtual hard disks; the Winhex software allows
the file system of the disks to be viewed, which will assist in locating and
reading artefacts in the live file set. Functionality, such as templates and basic
scripting, will be used to assist in ascertaining the structure of the thumbnail
cache and related files; once the templates are created they will be applied to
Page 44