Vista thumbcache

From ForensicsWiki
Revision as of 06:21, 19 March 2009 by .FUF (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Windows Vista stores thumbnails in the following directory: \Users\\AppData\Local\Microsoft\Windows\Explorer

This directory contains following files:

  • thumbcache_idx.db
  • thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, and thumbcache_1024.db
  • thumbcache_sr.db

Thumbnails are stored in thumbcache_NN.db files in different formats (e.g. BMP) and can be extracted using file carving. There are several tools that can work with Vista Thumbcache: dmThumbs, Thumbs.db Viewer, and FTK. Unfortunately, there is no information in the thumbcache that can easily link thumbnails with original files in all cases. One of the ways to link thumbnails with original files is to use Windows Indexer (Windows.edb) database.

Thumbcache format is described here.

External Links