ForensicsWiki will continue to operate as it has before and will not be shutting down. There may be some minor outages as we transition the site to new hardware, but we will try to minimize this as much as possible. Thank you for your continued support of ForensicsWiki.

Difference between pages "Thumbs.db" and "DeepSpar Disk Imager"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
 
Line 1: Line 1:
Thumbs.db is a file created by windows when thumbnail view is used. It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their windows folders.
+
; [[DeepSpar Disk Imager]]
 
+
[[Image:DeepSpardiskimager.jpg]],
The thumbnails in Thumbs.db are stored in a OLE 2 Compound Document format. It's the same format that MS Office uses.
+
:An independently written review of the DeepSpar Disk Imager written by Mike Montgomery of MJM Data Recovery in the UK is available at: http://www.deepspar.com/mjm-ds-disk-imager.html
 
+
:The whitepaper "Disk Imaging: A Vital Step in Data Recovery" is available to download from: http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf.
There is a forensic application developed under the open source project over at sourceforge called vinetto at http://sourceforge.net/projects/vinetto that can extract them. It does require a python enviornment. Additionally there are several other java solutions based around the Jakarta project that is apart of Apache.  Additional resources about thumbs.db can be found in a white paper at http://www.accessdata.com/media/en_US/print/papers/wp.Thumbs_DB_Files.en_us.pdf.
+
:The product data sheet can be downloaded from: http://www.deepspar.com/pdf/DeepSparDiskImager.pdf.
 
+
=Windows Vista=
+
Thumbs.db no longer exists in Vista.  This data has been moved to ''User Profile/Application Data/Microsoft Internet Explorer/Thumbscache32, 96 and 128'''
+

Revision as of 19:07, 11 April 2007

DeepSpar Disk Imager

DeepSpardiskimager.jpg,

An independently written review of the DeepSpar Disk Imager written by Mike Montgomery of MJM Data Recovery in the UK is available at: http://www.deepspar.com/mjm-ds-disk-imager.html
The whitepaper "Disk Imaging: A Vital Step in Data Recovery" is available to download from: http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf.
The product data sheet can be downloaded from: http://www.deepspar.com/pdf/DeepSparDiskImager.pdf.