SLAMorris Final Thesis After Corrections.pdf - Cranfield University

In order to determine an artefact was created while the machine was
working properly it is necessary to determine the system behaviour which
led to an artefacts current state.
In order to establish the behaviour an artefact represents it is necessary
to form relationships with other artefacts to identify potential system
activity.
A relationship between artefacts can be defined as an association
between artefacts; the relationship may provide corroboration or
supplementary information that enhances what is known about the
system activity.
Maximising corroboration can be defined as verifying and providing
additional information the artefact with other alternative sources of
information.
The maximum amount of data retrieved is defined as the identification
and reassembly of all thumbnail cache file fragments used during the
research.
Automation is defined as a scientific process which has been
implemented to minimise the interaction of an analyst.
4.4 Process Criteria
This chapter has identified criteria which can be used to evaluate the evidential
value of thumbnail cache artefacts; some requirements emerging from the
discussion of evidential value suggest constraints outside the scope of this
research, but which apply to any investigation in which the results of this
research were applied. They are documented below, for completeness.
4.4.1 Provenance of Artefacts
In order to ensure the original data to be preserved the analysis is generally
performed on a verified image of the original storage media.
Page 60