An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache

Simple item page
dc.contributor.authorMorris, Sarah
dc.contributor.authorChivers, Howard
dc.date.accessioned2018-10-19T10:24:18Z
dc.date.available2018-10-19T10:24:18Z
dc.date.issued2011-06-28
dc.description.abstractOperating systems such as Windows 7 implement a thumbnail cache structure to store visual thumbnails and associated metadata. There is no standard implementation of a thumbnail cache or its functions, which has led developers to implement their own structures and behaviour. The artefacts present within a thumbnail cache are of interest to a forensic analyst as they can provide information on files within the system which may be of use to the investigation. This research investigates the structure and behaviour of the thumbnail cache implemented in Windows 7 and shows that as well as storing information relating to visual thumbnails the cache also stores the names of networked computers, GUIDs relating to system artefacts and allocated drive letter information. It also shows that due to the behaviour of the cache, information such as records relating to files which are no longer on the system may be available, proving interesting forensic evidence.en_UK
dc.identifier.citationSarah Morris and Howard Chivers. An analysis of the structure and behaviour of the Windows 7 operating system thumbnail cache. Proceedings from 1st International Conference on Cybercrime, Security and Digital Forensics, 27-28 June 2011, University of Strathclyde, Glasgow, Scotland, UK.en_UK
dc.identifier.isbn9780947649784
dc.identifier.urihttp://dspace.lib.cranfield.ac.uk/handle/1826/13547
dc.language.isoenen_UK
dc.publisherUniversity of Strathclyde, Glasgowen_UK
dc.subjectthumbnail cacheen_UK
dc.subjectwindows 7en_UK
dc.subjectforensic computingen_UK
dc.titleAn analysis of the structure and behaviour of the Windows 7 operating system thumbnail cacheen_UK
dc.typeConference paperen_UK

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Windows_7_operating_system_thumbnail_cache-2011.pdf
Size:
225.58 KB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.63 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

Staff publications (CDS)