ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn


From ForensicsWiki
Revision as of 10:00, 31 January 2009 by Joachim Metz (Talk | contribs)

Jump to: navigation, search

Thumbs.db is a file created by Windows when thumbnail view is used. It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their Windows folders.

The thumbnails in Thumbs.db are stored in the OLE Compound File format. It's the same format that Microsoft Office uses.

There is a forensic open source application developed at sourceforge called vinetto at that can extract them. It does require a python environment. Additionally, there are several other Java solutions based around the Jakarta project that is apart of Apache. Additional resources about thumbs.db can be found in a white paper at

MiTeC Windows File Analyzer [1] is a tool for forensic analysis of Thumbnail Databases, Prefetch files, shortcuts, IExplore Index.DAT files and Recycle Bin contents on a Windows system. It will print a report of analyzed files.

Windows Vista

Thumbs.db no longer exists in Vista. This data has been moved to \Users\\AppData\Local\Microsoft\Windows\Explorer

Windows Vista will save thumbnails for files on a mounted encrypted file systems (except EFS).