SLAMorris Final Thesis After Corrections.pdf - Cranfield University

5 The Structure and Behaviour of the Operating System
Thumbnail Cache Implementations used in Ubuntu
and Kubuntu
5.1 Introduction
This chapter identifies the artefacts recovered from the operating system
thumbnail caches used in Ubuntu and Kubuntu and evaluates their evidential
strength against the criteria established in Chapter 4.
Kubuntu is an implementation of the Ubuntu Linux distribution that implements
the KDE graphical desktop environment rather than Ubuntu’s default graphical
interface. An open desktop specification for thumbnail caches specifies that
each system should implement a single cache which can be utilised by both the
operating system and applications [Finke, 2004]. The file managers used in
both Kubuntu and Ubuntu base their thumbnail cache implementations on this
specification; a file manager provides a graphical interface to the file system.
The specification does not specify the user activity which leads to the thumbnail
cache being manipulated. Therefore both file managers may implement the
specification for the user activity involved in their systems differently; the
forensic significance of the artefacts may be significantly different in each case.
This chapter is organised as follows, first the basic methodology employed in
this section is described [Section 5.2]. This is followed by an overview of the
Linux thumbnail caches and a description of the artefacts found on a default
installation [Sections 5.3 - 5.4]. Next, the structure of the thumbnail cache
implementations used in Ubuntu and Kubuntu are identified; followed by an
analysis of their behaviour based on user activity [Sections 5.5 - 5.6]. In
Section 5.7 the artefacts found on the rest of the system which corroborate
thumbnail cache information are identified. Section 5.8 explores how the
Page 63