Thumbs.db - Revision history

Phillmoore87: /* Windows Vista */

2011-09-09T08:13:34Z

‎Windows Vista

2010-10-24T08:52:26Z

‎Windows Vista

2010-02-26T10:22:48Z

2009-03-19T13:05:16Z

2009-03-19T09:26:10Z

2009-01-31T10:00:40Z

2009-01-31T09:59:59Z

2008-12-30T11:16:14Z

2008-12-30T00:12:17Z

‎Windows Vista

2008-11-29T19:44:52Z

@@ Line 7: / Line 7: @@
 MiTeC Windows File Analyzer [http://www.mitec.cz/wfa.html] is a tool for forensic analysis of Thumbnail Databases, [[Prefetch]] files, [[LNK | shortcuts]], IExplore Index.DAT files and Recycle Bin contents on a [[Windows]] system. It will print a report of analyzed files.
-= Windows Vista =
+= Windows Vista/7 =
 ''See [[Vista thumbcache]]''
-Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\%username%\AppData\Local\Microsoft\Windows\Explorer''
+Thumbs.db no longer exists in Vista/7 as individual files. This data has been moved to a centralized database located in ''\Users\%username%\AppData\Local\Microsoft\Windows\Explorer''
 [[Windows]] Vista will save thumbnails for files on mounted encrypted file systems (except [[Windows Encrypted File System | EFS]]).

@@ Line 11: / Line 11: @@
 ''See [[Vista thumbcache]]''
-Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''
+Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\%username%\AppData\Local\Microsoft\Windows\Explorer''
 [[Windows]] Vista will save thumbnails for files on mounted encrypted file systems (except [[Windows Encrypted File System | EFS]]).

← Older revision		Revision as of 10:22, 26 February 2010
Line 14:		Line 14:

	[[Windows]] Vista will save thumbnails for files on mounted encrypted file systems (except [[Windows Encrypted File System \| EFS]]).		[[Windows]] Vista will save thumbnails for files on mounted encrypted file systems (except [[Windows Encrypted File System \| EFS]]).
		+
		+	== External Links ==
		+
		+	* [http://www.thumbnailexpert.com/en/formats/windows-thumbnail-cache/ Windows thumbnail cache (thumbs.db)]

	[[Category:File Formats]]		[[Category:File Formats]]

@@ Line 13: / Line 13: @@
 Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''
-[[Windows]] Vista will save thumbnails for files on a mounted encrypted file systems (except [[Windows Encrypted File System | EFS]]).
+[[Windows]] Vista will save thumbnails for files on mounted encrypted file systems (except [[Windows Encrypted File System | EFS]]).
 [[Category:File Formats]]

← Older revision		Revision as of 09:26, 19 March 2009
Line 8:		Line 8:

	= Windows Vista =		= Windows Vista =
		+
		+	''See [[Vista thumbcache]]''
		+
	Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''		Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''

@@ Line 1: / Line 1: @@
 Thumbs.db is a file created by [[Windows]] when [[Thumbnails|thumbnail]] view is used.  It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their [[Windows]] folders.
-The [[thumbnails]] in Thumbs.db are stored in the [[OLE Compound file]] format. It's the same format that [[Microsoft Office]] uses.
+The [[thumbnails]] in Thumbs.db are stored in the [[OLE Compound File]] format. It's the same format that [[Microsoft Office]] uses.
 There is a forensic open source application developed at sourceforge called [[vinetto]] at http://sourceforge.net/projects/vinetto that can extract them.  It does require a python environment.  Additionally, there are several other Java solutions based around the Jakarta project that is apart of Apache.  Additional resources about thumbs.db can be found in a white paper at http://www.accessdata.com/media/en_US/print/papers/wp.Thumbs_DB_Files.en_us.pdf.

← Older revision		Revision as of 11:16, 30 December 2008
Line 10:		Line 10:
	Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''		Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''

−	[[Windows]] Vista will save thumbnails for files on a mounted encrypted filesystems.	+	[[Windows]] Vista will save thumbnails for files on a mounted encrypted filesystems (except [[Windows Encrypted File System \| EFS]]).

← Older revision		Revision as of 00:12, 30 December 2008
Line 10:		Line 10:
	Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''		Thumbs.db no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''

−	[[Windows]] Vista will save thumbnails for files on a mounted ~~[[TrueCrypt]] volume~~.	+	[[Windows]] Vista will save thumbnails for files on a mounted encrypted filesystems.