SLAMorris Final Thesis After Corrections.pdf - Cranfield University

The tEXt chunks contain the metadata on the original file and the visual
thumbnail; there are usually several tEXt chunks in each file. Each tEXt chunk
holds a single piece of metadata in the form of a key and a value; the key
specifies the meaning of the value. The keys may be inbuilt into the PNG
format, specific for the thumbnail cache or for the file type. Thumbnail cache
specific keys start with ‘Thumb’, all keys are written in ASCII, and are clearly
defined making it simple for a forensic examiner to interpret them; for example
‘Thumb:MTime’, is the key for the modification date of the source file. The
modification time and URI of the source file are generally present in all
subrecords. Other information, such as the dimensions of the original file and
the number of pages it contained may also be present.
The visual thumbnail itself is stored within one or more IDAT chunks, which are
compliant with the PNG specification. Finally each subrecord file ends with an
IEND chunk, which denotes the end of a file.
The following is an example thumbnail cache record viewed in a hex editor; it
has been annotated to show the structure and meaning of each byte.
Start of PNG file
00000000 89 50 4E 47 0D 0A 1A 0A
89 50 4E 47 0D 0A 1A 0A - PNG header
This is the PNG file signature, it is 8 bytes long. It shows that the remainder of
the file is in PNG format, conforming to the chunk structure described above.
The signature also shows the file contains a single PNG image, which means
that only one visual thumbnail is stored in this file.
Page 73