SLAMorris Final Thesis After Corrections.pdf - Cranfield University

the way data changes. The experiments were performed on virtual machines,
each with a 6GB hard drive, and the operating systems were downloaded in an
ISO format from the Ubuntu website [Ubuntu: Lucid, 2010]. The installation
used the default settings and no additional packages were installed, to replicate
a typical user configuration. The virtual machines created were saved and used
as baseline machines; each experiment used a virtual machine cloned from a
baseline virtual machine. This enabled any changes in the data to be compared
with the original configuration. For some experiments, experimental virtual
machines were compared with each other as well as a baseline image, for
example when looking at how modifying a file affects the data in the thumbnail
cache.
The virtual disk images are examined using a hexadecimal editor, and are also
mounted to enable the examination of the live system files. The results are also
compared with data available on the operating systems, such as source code,
the open desktop thumbnail cache specification and Ubuntu forum posts. To
permit the automated extraction of artefacts from the thumbnail cache, a Python
program will be created to extract any relevant information such as metadata or
visual thumbnails which are identified during this research.
5.3 Thumbnail caches
Figure 5.1 shows a screenshot of Nautilus is the file manager used in Ubuntu
10.10, it provides a graphical interface to the system [Ubuntu: Lucid, 2010].
Within the file browser windows, the default setting is to display visual
thumbnails of files. However, not all file types display visual thumbnails by
default, for example in Ubuntu 10.10 office documents [OpenOffice, 2012]. For
files such as PDF and image formats, the thumbnails shown in the browser are
of a large enough size to aid the identification of the original file.
Page 65