An Investigation into the identification, reconstruction, and evidential value of thumbnail cache file fragments in unallocated space

©Cranfield UniversityThis thesis establishes the evidential value of thumbnail cache file fragments identified in unallocated space. A set of criteria to evaluate the evidential value of thumbnail cache artefacts were created by researching the evidential constraints present in Forensic Computing. The criteria were used to evaluate the evidential value of live system thumbnail caches and thumbnail cache file fragments identified in unallocated space. Thumbnail caches can contain visual thumbnails and associated metadata which may be useful to an analyst during an investigation; the information stored in the cache may provide information on the contents of files and any user or system behaviour which interacted with the file. There is a standard definition of the purpose of a thumbnail cache, but not the structure or implementation; this research has shown that this has led to some thumbnail caches storing a variety of other artefacts such as network place names. The growing interest in privacy and security has led to an increase in user’s attempting to remove evidence of their activities; information removed by the user may still be available in unallocated space. This research adapted popular methods for the identification of contiguous files to enable the identification of single cluster sized fragments in Windows 7, Ubuntu, and Kubuntu. Of the four methods tested, none were able to identify each of the classifications with no false positive results; this result led to the creation of a new approach which improved the identification of thumbnail cache file fragments. After the identification phase, further research was conducted into the reassembly of file fragments; this reassembly was based solely on the potential thumbnail cache file fragments and structural and syntactical information. In both the identification and reassembly phases of this research image only file fragments proved the most challenging resulting in a potential area of continued future research. Finally this research compared the evidential value of live system thumbnail caches with identified and reassembled fragments. It was determined that both types of thumbnail cache artefacts can provide unique information which may assist with a digital investigation. ii This research has produced a set of criteria for determining the evidential value of thumbnail cache artefacts; it has also identified the structure and related user and system behaviour of popular operating system thumbnail cache implementations. This research has also adapted contiguous file identification techniques to single fragment identification and has developed an improved method for thumbnail cache file fragment identification. Finally this research has produced a proof of concept software tool for the automated identification and reassembly of thumbnail cache file fragments

A Primal-Dual Proximal Algorithm for Sparse Template-Based Adaptive Filtering: Application to Seismic Multiple Removal

Unveiling meaningful geophysical information from seismic data requires to deal with both random and structured "noises". As their amplitude may be greater than signals of interest (primaries), additional prior information is especially important in performing efficient signal separation. We address here the problem of multiple reflections, caused by wave-field bouncing between layers. Since only approximate models of these phenomena are available, we propose a flexible framework for time-varying adaptive filtering of seismic signals, using sparse representations, based on inaccurate templates. We recast the joint estimation of adaptive filters and primaries in a new convex variational formulation. This approach allows us to incorporate plausible knowledge about noise statistics, data sparsity and slow filter variation in parsimony-promoting wavelet frames. The designed primal-dual algorithm solves a constrained minimization problem that alleviates standard regularization issues in finding hyperparameters. The approach demonstrates significantly good performance in low signal-to-noise ratio conditions, both for simulated and real field seismic data

Advanced Techniques for Fast and Accurate Heritage Digitisation in Multiple Case Studies

All elements of heritage are exposed to more or less predictable risks. Even though they are in a good state of conservation with economic support for their repair or maintenance, they can suffer sudden accidents leading to their imminent destruction. It is therefore necessary to safeguard them in all scenarios, regardless of the respective scale or state of conservation. That process must at least be based on complete and accurate 3D digitisation. The evolution of devices, software/hardware and platforms nowadays allows such information to be gathered in a sustainable manner. Various existing resources were tried and compared at several heritage sites of different scales with dissimilar risk and protection, following the guidelines of different ICOMOS (International Council on Monuments and Sites) committees. Each case study addresses the choice of digitisation techniques and the characteristics of the end product obtained. The most suitable modality for each situation is analysed, depending on different factors such as accessibility and risks faced. Although the 3D laser scanner is clearly a very fast and very accurate resource, automated photogrammetry is one of the more accessible and affordable resources; along with the potential of UAVs (unmanned aerial vehicles), this enables the digitisation to be sustainably completed

Methodology and automated metadata extraction from multiple volume shadow copies

Modern day digital forensics investigations rely on timelines as a principal method for normalizing and chronologically categorizing artifacts recovered from computer systems. Timelines provide investigators with a chronological representation of digital evidence so they can depict altered and unaltered digital forensics data in-context to drive conclusions about system events and/or user activities. While investigators rely on many system artifacts such as file system time/date stamps, operating system artifacts, program artifacts, logs, and/or registry artifacts as input for deriving chronological representations, using only the available or most recent version of the artifacts may provide a limited picture of historical changes on a system. For instance, if previous versions of artifacts and/or previous artifact metadata changes are overwritten and/or are not retained on a system, analysis of current versions of artifacts and artifact metadata, such as time/date stamps and operating system/program/registry artifacts, may provide only a limited picture of activities for the system. Recently, the Microsoft Windows Operating System implemented a backup mechanism that is capable of retaining multiple versions of data storage units for a system, effectively providing a highly-detailed record of system changes. This backup mechanism, the Windows Volume Shadow Copy Service (VSS), exists as a service of modern Microsoft Windows Operating Systems and allows data backups to be performed while applications on a system continue to write to the system\u27s live volume(s). This allows a running system to preserve the system\u27s state to backup media at any given point while the system continues to change in real-time. After multiple VSS backups are recorded, digital investigators now have the ability to incorporate multiple versions of a system\u27s artifacts into a chronological representation, which provides a more comprehensive picture of the system\u27s historical changes. In order to effectively incorporate VSS backup, or Volume Shadow Copy (VSC), data into a chronological representation, the data must be accessed and extracted in a consistent, repeatable, and, if possible, automated manner. Previous efforts have produced a variety of manual and semi-automated methods for accessing and extracting VSC data in a repeatable manner. These methods are time consuming and often require significant storage resources if dealing with multiple VSCs. The product of this research effort is the advancement of the methodology to automate accessing and extracting directory-tree and file attribute metadata from multiple VSCs of the Windows 7 Operating System. The approach extracts metadata from multiple VSCs and combines it as one conglomerate data set. By capturing the historical changes recorded within VSC metadata, this approach enhances timeline generation. Additionally, it supports other projects which could use the metadata to visualize change-over-time by depicting how the individual metadata and the conglomerate data set changed (or remained unchanged) throughout an arbitrary snapshot of time

Análise microscópica e radiográfica do efeito do tamanho das partículas de matriz de osso medular bovino desmineralizado na reparação de defeito ósseo em fêmures de coelhos

The bone tissue has a great regenerative potential, with ability to completely restore its structure and original functions. In some situations, though, bone defects cannot be self-repaired, thus requiring the use of grafts for a correct treatment and good prognosis. This work aimed at microscopically analyzing the effect of the particle size of demineralized bovine cancellous bone matrix in micro and macrogranular forms on the repair of bone defects in femurs of rabbits, with blood clot used as control. At 1, 3 and 6 months after implantation of the materials, the animals were killed and the anatomic specimens were removed. A foreign body-type granulomatous reaction containing macrophages and multinucleated giant cells in contact with the implanted particles was observed. These results suggest a failure in demineralization and/or interruption of the antigenic potential during production of the biomaterial. It is concluded that the size of the particles did not influence the evolution of the repair process of bone defects, acting only as bone-filler substances, and that the material implanted should be improved by quality control during production, since it may represent a good alternative for bone graft.O tecido ósseo possui grande potencial regenerativo com capacidade para restaurar completamente sua estrutura e função originais. Há situações em que os defeitos ósseos não conseguem por si só obter o reparo, casos em que se fazem necessários o uso de enxertos, para um correto tratamento e bom prognóstico. Este experimento teve o propósito de analisar microscopicamente o efeito do tamanho das partículas de matriz de osso medular bovino desmineralizado, nas formas micro e macrogranular, na reparação de defeito ósseo em fêmures de coelhos, tendo como controle o coágulo sanguíneo. Após 1,3 e 6 meses da implantação dos materiais, os animais foram mortos e as peças anatômicas removidas. Uma reação granulomatosa tipo corpo estranho, envolvendo as partículas implantadas, foi observada. Estes resultados sugerem falhas na desmineralização e/ou na retirada de potenciais antigênicos durante a produção do biomaterial. Podemos concluir que o tamanho das partículas não influenciou na evolução do processo reparativo dos defeitos ósseos, atuando apenas como substâncias osteopreenchedoras e que o material implantado deverá sofrer um aprimoramento no controle de qualidade na linha de produção, uma vez que poderá representar uma boa alternativa para enxertos ósseos

Aspects of the tectonics of the Greater Caucasus and Western South Caspian Basin

The main objectives of this project are to (a) understand the relationship between climate, topography and the tectonics in the Greater Caucasus belt, (b) construct regional geological cross-sections showing major stratigraphic sequences and structures along the belt using the focal mechanisms of the earthquakes events, (c) evaluate the evolution and development of a single fold structure (Yasamal anticline) and (d) investigate strain accommodation mechanisms using 3D Move to unfold the Yasamal structure. Topographic variations were investigated to understand the interplay between topography, climate and the tectonics of the Greater Caucasus range and compare the findings with other active and inactive belts (Pyrenees, Northern Tibetan Plateau and Himalayas). There is a correlation between elevation changes and climate along the Greater Caucasus belt, where the gradual reduction of the mean altitude, has a close relationship with a wetter climate, and the sharper altitude decrease with a drier climate. And the elevation changes are strongly correlated with the Moho depths underneath the region. The relief along the belt is extremely high, with a strong correlation between the high relief and the large thrusts in the region. And the relief of the eastern part is slightly low compared with the western part of the belt, even though the eastern part is more active than the western part. The structural study undertaken at regional scale for the Caucasus belt and the western side of the South Caspian Basin gave insights on the style of deformation in the basin and the evolution of the Greater Caucasus belt and the preferred distribution, geometry and formation mechanism of the structural elements. The regional cross-sections along the Greater Caucasus were constructed and constrained by using focal mechanisms show that the belt is deformed by active thrust faults that dip inwards from the margins of the range where the northern thrusts are dipping south, and the southern thrusts are dipping to the north, these results have contrary to some previous models that emphasise only south-directed thrusting. The spatial arrangement, geometry and temporal evolution of spectacular kilometre-amplitude fold structures actively forming in Cenozoic sediments on the uplifted western margin of the South Caspian Basin are described and strain accommodation mechanisms established using 3D Move to unfold the Yasamal structure enabled a reconstruction of pre-folding templates and predictively model the fold-related deformation at small-scale. The 3D model of the Yasamal anticline shows that the anticline hinge has about 30° south-directed plunging. The area was characterized by a low rate of sedimentation and high rate of uplift in the Upper Pliocene. The minor structures (accommodating the overall strain in the anticline) are developed throughout the entire anticline. Compressional strain is present at the anticline hinge line, and the extensional strain dominates the anticline limbs. Suggesting potential extensional structures development in the anticline flanks, which correspond with the field observations in the Yasamal valley confirming that; the small normal faults are concentrated within the anticline flanks, and the contractional deformation bands along the hinge area of the anticline