SLAMorris Final Thesis After Corrections.pdf - Cranfield University

thumbnail cache responds to artefacts being altered, whilst Section 5.9
identifies methods of forming a relationship between information in the
thumbnail cache and an original source file. A brief discussion of artefacts
relating to audio and media thumbnails is provided in Section 5.10; followed by
a discussion of the strengths of the evidential artefacts identified during
experimentation in Section 5.11. Finally, Section 5.12 provides a conclusion to
this chapter.
5.2 Methodology
In order to compare the structure and behaviour of different implementations of
the thumbnail cache it is necessary to establish the methodology which will be
implemented during the research. This section describes the overall
methodology employed in this chapter; investigations of different aspects
require specific experiments which are described in the relevant section below.
First research into existing resources relating to Linux and thumbnail caches are
identified and evaluated, which ensures that any methodology created takes
into account existing knowledge on the subject. The related reading described
in Chapter 2 identified that the thumbnail cache is stored in a hidden folder in
the user’s home directory. The main directory is named .thumbnails and
contains up to three sub-directories entitled fail, normal and large; the
directories and files are standard Linux implementations of these constructs. An
open desktop thumbnail cache specification exists [Finke, 2004]; however there
is no information to suggest the extent to which operating system implements it.
The specification provides a starting point for the experiments into establishing
the structure and syntax of the thumbnail cache.
In order to establish the structure and behaviour of the thumbnail cache and
thumbnail records, it is necessary to perform a variety of experiments to assess
Page 64