Windows thumbnail cache - Revision history

Sembiance: Added sample files

2023-12-28T15:10:07Z

Added sample files

Jsummers: /* Links */ Updating Forensics Wiki links

2023-09-04T14:41:34Z

‎Links: Updating Forensics Wiki links

Sembiance: /* Software */

2021-08-29T13:55:01Z

‎Software

Jsummers: Category:Windows

2017-03-29T21:00:08Z

Category:Windows

Dan Tobias: /* Links */

2017-03-09T23:29:35Z

‎Links

Jsummers at 16:32, 21 December 2016

2016-12-21T16:32:21Z

Jsummers: /* Software */

2016-12-04T16:15:21Z

‎Software

Jsummers: /* Format details */

2016-10-28T15:39:58Z

‎Format details

Jsummers at 15:39, 24 October 2016

2016-10-24T15:39:08Z

Jsummers at 15:14, 23 October 2016

2016-10-23T15:14:33Z

@@ Line 32: / Line 32: @@
 * [https://github.com/AtesComp/Vinetto Vinetto for python3]
 * {{Deark}}
 == Links ==

@@ Line 35: / Line 35: @@
 == Links ==
 * [[Wikipedia:Windows thumbnail cache|Wikipedia article]]
-* [http://www.forensicswiki.org/wiki/Thumbs.db Forensics Wiki article]
+* [{{ForensicsWikiURL|thumbs.db}} Forensics Wiki article]
 * [http://qanda.digipres.org/117/what-you-should-you-with-thumbs-and-other-hidden-system-files What do you (or should you do) with ‘thumbs.db’ and other hidden system files?]
 * [https://ad-pdf.s3.amazonaws.com/wp.Thumbs_DB_Files.en_us.pdf AccessData: THUMBS DB FILES FORENSIC ISSUES]

@@ Line 30: / Line 30: @@
 * [https://thumbcacheviewer.github.io/ Thumbcache Viewer]
 * [http://vinetto.sourceforge.net/ Vinetto]
 * {{Deark}}

@@ Line 42: / Line 42: @@
 [[Category:Microsoft]]
 [[Category:Microsoft Compound File]]
 [[Category:File formats with a distinctive filename]]

@@ Line 39: / Line 39: @@
 * [https://groups.google.com/forum/#!topic/droid-list/VMRCnzw71gc Developing a signature for thumbs.db]
 * [https://groups.google.com/forum/#!msg/droid-list/VMRCnzw71gc/3CO40cUu2vcJ More discussion on identifying thumbs.db]
 [[Category:Microsoft]]
 [[Category:Microsoft Compound File]]
 [[Category:File formats with a distinctive filename]]

@@ Line 10: / Line 10: @@
 == Format details ==
-Thumbs.db format is undocumented, and fairly difficult to decode. The are at least two different major thumbnail versions, which we'll call "original format" and "new format". There are an uncertain number of minor versions. Different thumbnail versions may be combined in the same file. Presumably, this can happen when Windows updates a file created by a different version of Windows.
+Thumbs.db format is undocumented, and fairly difficult to decode. Knowledge of [[Microsoft Compound File]] format is a prerequisite. There are at least two different major thumbnail versions, which we'll call "original format" and "new format". There are an uncertain number of minor versions. Different thumbnail versions may be combined in the same file. Presumably, this can happen when Windows updates a file created by a different version of Windows.
-Files that contain at least one "original format" thumbnail have a special stream named "Catalog", which contains the original filenames, and other information. One of the filenames may be the special name "{A42CD7B6-E9B9-4D02-B7A6-288B71AD28BA}". This is apparently the thumbnail for the folder itself. The thumbnail streams themselves have simple numeric names like "021", which are to be reversed and interpreted as a Catalog ID number (120, in this case).
+Files that contain at least one "original format" thumbnail have a special stream named "Catalog", which contains the original filenames, and other information. One of the filenames may be the special name "{A42CD7B6-E9B9-4D02-B7A6-288B71AD28BA}". This is apparently the thumbnail for the folder as a whole. The thumbnail streams themselves have simple numeric names like "021", which are to be reversed and interpreted as a Catalog ID number (120, in this example).
 Thumbnails in "new format" do not use a Catalog file. Instead, the streams have names like "256_79dea834bece3f6b", apparently containing a pixel size and a hash.
@@ Line 20: / Line 20: @@
 There are are at least three different image formats that a thumbnail may use:
 # Standard [[JFIF]] JPEG format
-# A nonstandard RGBA format based on [[JPEG]]
+# A nonstandard RGBA format based on [[JPEG]] (At least, the [[JPEG#Color format|component ID numbers]] suggest that the format is RGBA. Thumbs Viewer can display these images, and its author says it is CMYK.)
 # [[PNG]]

@@ Line 5: / Line 5: @@
 |pronom={{PRONOM|fmt/682}}
 }}
-'''Windows thumbnail cache''' is a file format used by some versions of Microsoft Windows to store thumbnails of images and certain other file types. Thumbnails may be written to a file named <code>Thumbs.db</code> in the folder containing the image file, or to a file in a central location. The file format is based on [[Microsoft Compound File]] format. Apparently the files can be of forensic interest as they sometimes contain references to deleted images.
+'''Windows thumbnail cache''' (or '''Thumbs.db''' format) is a file format used by some versions of Microsoft Windows to store thumbnails of images and certain other file types. Thumbnails may be written to a file named <code>Thumbs.db</code> in the folder containing the image file, or to a file in a central location. The file format is based on [[Microsoft Compound File]] format. Apparently the files can be of forensic interest as they sometimes contain references to deleted images.
-In versions starting with Vista, separate thumbnail files are no longer used, with the thumbnails instead being stored in a centralized database at <code>\Users\%username%\AppData\Local\Microsoft\Windows\Explorer</code>.
+In versions starting with Vista, separate thumbnail files are ''usually'' no longer used, with the thumbnails instead being stored in a centralized database at <code>\Users\%username%\AppData\Local\Microsoft\Windows\Explorer</code>. However, separate Thumbs.db files may still be created on network drives.
 == Software ==
@@ Line 24: / Line 41: @@
 [[Category:Microsoft]]
 [[Category:Microsoft Compound File]]