Windows thumbnail cache
From Just Solve the File Format Problem
(Difference between revisions)
Ross-spencer (Talk | contribs) (Added link to external PDF containing useful forensics information.) |
Dan Tobias (Talk | contribs) (→Links) |
||
| Line 18: | Line 18: | ||
* [http://qanda.digipres.org/117/what-you-should-you-with-thumbs-and-other-hidden-system-files What do you (or should you do) with ‘thumbs.db’ and other hidden system files?] | * [http://qanda.digipres.org/117/what-you-should-you-with-thumbs-and-other-hidden-system-files What do you (or should you do) with ‘thumbs.db’ and other hidden system files?] | ||
* [https://ad-pdf.s3.amazonaws.com/wp.Thumbs_DB_Files.en_us.pdf AccessData: THUMBS DB FILES FORENSIC ISSUES] | * [https://ad-pdf.s3.amazonaws.com/wp.Thumbs_DB_Files.en_us.pdf AccessData: THUMBS DB FILES FORENSIC ISSUES] | ||
| + | * [https://groups.google.com/forum/#!topic/droid-list/VMRCnzw71gc Developing a signature for thumbs.db] | ||
[[Category:Microsoft]] | [[Category:Microsoft]] | ||
Revision as of 11:50, 29 July 2014
Windows thumbnail cache is a file format used by some versions of Microsoft Windows to store thumbnails of images and certain other file types. Thumbnails may be written to a file named Thumbs.db in the folder containing the image file, or to a file in a central location. The file format is based on Microsoft Compound File format. Apparently the files can be of forensic interest as they sometimes contain references to deleted images.
In versions starting with Vista, separate thumbnail files are no longer used, with the thumbnails instead being stored in a centralized database at \Users\%username%\AppData\Local\Microsoft\Windows\Explorer.
