Difference between pages "Thumbs.db" and "DeepSpar Disk Imager"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
 
Line 1: Line 1:
Thumbs.db is a file created by windows when thumbnail view is used. It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their windows folders.
+
; [[DeepSpar Disk Imager]]
 
+
[[Image:DeepSpardiskimager.jpg]],
The thumbnails in Thumbs.db are stored in a OLE 2 Compound Document format. It's the same format that MS Office uses.
+
:An independently written review of the DeepSpar Disk Imager written by Mike Montgomery of MJM Data Recovery in the UK is available at: http://www.deepspar.com/mjm-ds-disk-imager.html
 
+
:The whitepaper "Disk Imaging: A Vital Step in Data Recovery" is available to download from: http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf.
There is a forensic application developed under the open source project over at sourceforge called vinetto at http://sourceforge.net/projects/vinetto that can extract them. It does require a python enviornment. Additionally there are several other java solutions based around the Jakarta project that is apart of Apache.  Additional resources about thumbs.db can be found in a white paper at http://www.accessdata.com/media/en_US/print/papers/wp.Thumbs_DB_Files.en_us.pdf.
+
:The product data sheet can be downloaded from: http://www.deepspar.com/pdf/DeepSparDiskImager.pdf.
 
+
=Windows Vista=
+
Thumbs.db no longer exists in Vista.  This data has been moved to ''User Profile/Application Data/Microsoft Internet Explorer/Thumbscache32, 96 and 128'''
+

Revision as of 14:07, 11 April 2007

DeepSpar Disk Imager

DeepSpardiskimager.jpg,

An independently written review of the DeepSpar Disk Imager written by Mike Montgomery of MJM Data Recovery in the UK is available at: http://www.deepspar.com/mjm-ds-disk-imager.html
The whitepaper "Disk Imaging: A Vital Step in Data Recovery" is available to download from: http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf.
The product data sheet can be downloaded from: http://www.deepspar.com/pdf/DeepSparDiskImager.pdf.