Vista thumbcache - Revision history

Joachim Metz: /* ThumbnailCacheId */

2012-09-25T05:39:33Z

‎ThumbnailCacheId

2012-09-25T05:39:12Z

‎External Links

2012-08-26T07:51:57Z

‎Overview

2012-08-26T07:51:14Z

2012-08-26T07:46:53Z

‎External Links

2012-08-26T07:46:29Z

‎External Links

2011-09-11T11:21:01Z

2011-09-11T00:58:46Z

‎Overview

2010-11-12T16:01:20Z

‎External Links

2010-10-24T08:53:08Z

‎Overview

@@ Line 58: / Line 58: @@
 === ThumbnailCacheId ===
 * [http://msdn.microsoft.com/en-us/library/windows/desktop/bb787580(v=vs.85).aspx System.ThumbnailCacheId]
 === Non-English ===

@@ Line 55: / Line 55: @@
 * [http://www.whereisyourdata.co.uk/data/modules/wfdownloads/visit.php?cid=4&lid=9 Forensic Implications of Windows Vista, Barrie Stewart, 2007]
 * [http://code.google.com/p/libwtcdb/downloads/detail?name=Windows%20Explorer%20Thumbnail%20Cache%20database%20format.pdf Windows Explorer Thumbnail Cache database (thumbcache.db) format], by the [[libwtcdb|libwtcdb project]]
 === Non-English ===

@@ Line 1: / Line 1: @@
 == Overview ==
-[[Windows]] Vista stores [[Thumbnails | thumbnails]] in the following directory: ''\Users\%username%\AppData\Local\Microsoft\Windows\Explorer''
+[[Windows]] Vista stores [[Thumbnails | thumbnails]] in the following directory:
 This directory contains following files:

@@ Line 48: / Line 48: @@
 Windows Vista includes a built-in picture previewing tool called Windows Photo Gallery (the LIVE edition may also be installed by the user).  Both of these programs create the files ''pictures.pd4'' and ''pictures.pd5'' respectively containing the ''ThumbnailCacheID'' and file path information of previewed pictures and videos. The contents of the pictures.pd4 and pictures.pd5 can be extracted using [http://www.simplecarver.com/tool.php?toolname=WPG%20Viewer WPG Viewer]
 == External Links ==
 * [http://www.whereisyourdata.co.uk/data/modules/wfdownloads/visit.php?cid=4&lid=9 Forensic Implications of Windows Vista, Barrie Stewart, 2007]
 * [http://code.google.com/p/libwtcdb/downloads/detail?name=Windows%20Explorer%20Thumbnail%20Cache%20database%20format.pdf Windows Explorer Thumbnail Cache database (thumbcache.db) format], by the [[libwtcdb|libwtcdb project]]
 === Non-English ===
-* [http://itdefence.ru/content/articles/Thumbnails.Suhanov/ Использование централизованных баз данных эскизов для исследования графических файлов на зашифрованных разделах], ITDefence, 2009 ([http://www.securitylab.ru/analytics/370474.php extended version])
+== Tools ==

@@ Line 56: / Line 56: @@
 * [http://www.whereisyourdata.co.uk/data/modules/wfdownloads/visit.php?cid=4&lid=9 Forensic Implications of Windows Vista, Barrie Stewart, 2007]
-* [http://code.google.com/p/libwtcdb/downloads/detail?name=Windows%20Explorer%20Thumbnail%20Cache%20database%20format.pdf Windows Explorer Thumbnail Cache database (thumbcache.db) format]
+* [http://code.google.com/p/libwtcdb/downloads/detail?name=Windows%20Explorer%20Thumbnail%20Cache%20database%20format.pdf Windows Explorer Thumbnail Cache database (thumbcache.db) format], by the [[libwtcdb|libwtcdb project]]
 === Non-English ===
 * [http://itdefence.ru/content/articles/Thumbnails.Suhanov/ Использование централизованных баз данных эскизов для исследования графических файлов на зашифрованных разделах], ITDefence, 2009 ([http://www.securitylab.ru/analytics/370474.php extended version])

← Older revision		Revision as of 11:21, 11 September 2011
Line 48:		Line 48:

	Windows Vista includes a built-in picture previewing tool called Windows Photo Gallery (the LIVE edition may also be installed by the user). Both of these programs create the files ''pictures.pd4'' and ''pictures.pd5'' respectively containing the ''ThumbnailCacheID'' and file path information of previewed pictures and videos. The contents of the pictures.pd4 and pictures.pd5 can be extracted using [http://www.simplecarver.com/tool.php?toolname=WPG%20Viewer WPG Viewer]		Windows Vista includes a built-in picture previewing tool called Windows Photo Gallery (the LIVE edition may also be installed by the user). Both of these programs create the files ''pictures.pd4'' and ''pictures.pd5'' respectively containing the ''ThumbnailCacheID'' and file path information of previewed pictures and videos. The contents of the pictures.pd4 and pictures.pd5 can be extracted using [http://www.simplecarver.com/tool.php?toolname=WPG%20Viewer WPG Viewer]
		+
		+	== Tools ==
		+
		+	*[http://code.google.com/p/thumbcache-viewer/ Thumbcache-viewer]

	== External Links ==		== External Links ==

@@ Line 9: / Line 9: @@
 * thumbcache_sr.db
-Thumbnails are stored in ''thumbcache_NN.db'' files in different formats (e.g. [[BMP]]) and can be extracted using [[File Carving | file carving]]. There are several tools that can work with Vista Thumbcache: [http://www.dmthumbs.com/ dmThumbs], [http://www.janusware.com/fetch.php?page=412,2 Thumbs.db Viewer], [http://www.simplecarver.com/tool.php?toolname=WinThumbs%20Extractor WinThumbs] and [[FTK]]. Unfortunately, there is no information in the thumbcache that can easily link thumbnails with original files in all cases. One of the ways to link thumbnails with original files is to use Windows Indexer (Windows.edb) database.
+Thumbnails are stored in ''thumbcache_NN.db'' files in different formats (e.g. [[BMP]]) and can be extracted using [[File Carving | file carving]]. There are several tools that can work with Vista Thumbcache: [http://www.dmthumbs.com/ dmThumbs], [http://www.janusware.com/fetch.php?page=412,2 Thumbs.db Viewer], [http://www.simplecarver.com/tool.php?toolname=WinThumbs%20Extractor WinThumbs], [http://code.google.com/p/thumbcache-viewer thumbcache-viewer], and [[FTK]]. Unfortunately, there is no information in the thumbcache that can easily link thumbnails with original files in all cases. One of the ways to link thumbnails with original files is to use Windows Indexer (Windows.edb) database.
 == Thumbcache Format ==