Difference between pages "Thumbs.db" and "DeepSpar Disk Imager"
From Forensics Wiki
(Difference between pages)
|−|Thumbs. db is a file created by windows when thumbnail view is used. It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their windows folders. |+|
thumbnails in Thumbs.db are stored in a OLE 2 Compound Document format. It's the same format that MS Office uses. |+|
by is ...
The in is http://.//..
|−|There is a forensic application developed under the open source project over at sourceforge called vinetto at http:// sourceforge. net/ projects/ vinetto that can extract them. It does require a python enviornment. Additionally there are several other java solutions based around the Jakarta project that is apart of Apache. Additional resources about thumbs.db can be found in a white paper at http://www. accessdata.com/ media/ en_US/print/papers/wp.Thumbs_DB_Files.en_us.pdf. |+|
can be http://www..com//.pdf.
|−|=Windows Vista= |+|
|−|Thumbs.db no longer exists in Vista. This data has been moved to ''User Profile/Application Data/Microsoft Internet Explorer/Thumbscache32, 96 and 128''' |+|
Revision as of 13:07, 11 April 2007
- DeepSpar Disk Imager
- An independently written review of the DeepSpar Disk Imager written by Mike Montgomery of MJM Data Recovery in the UK is available at: http://www.deepspar.com/mjm-ds-disk-imager.html
- The whitepaper "Disk Imaging: A Vital Step in Data Recovery" is available to download from: http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf.
- The product data sheet can be downloaded from: http://www.deepspar.com/pdf/DeepSparDiskImager.pdf.