Difference between pages "Thumbnails" and "Microsoft Office File formats"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
 
{{expand}}
 
{{expand}}
  
'''Thumbnails''' are reduced-size versions of pictures, serving the same role for images as a normal text index does for words.
+
==Office versions, applications and file formats==
 +
* pre 95 DOS versions
 +
* pre 95 Windows versions
 +
** Microsoft Word 6.0
 +
* Microsoft Office 95
 +
* Microsoft Office 97 - 2003
 +
** Uses the [[OLE Compound File]] format for most of the file formats
 +
*** Microsoft Word uses the [[Word Document (DOC)]] file format
 +
*** Microsoft Excel uses the [[Excel Spreadsheet (XLS)]] file format
 +
*** Microsoft PowerPoint uses the [[PowerPoint Presentation (PPT)]] file format
 +
*** Microsoft Publisher
 +
*** Microsoft Visio
 +
** Microsoft Outlook uses multiple file formats for different purposes
 +
*** the [[Personal Folder File (PAB, PST, OST)]] format to store e-mails, appointments, tasks, notes, contacts, etc. The PFF format changed from a 32-bit to a 64-bit version in Outlook 2003.
 +
*** the [[Nickfile (NK2)]] format to store e-mail address aliases
 +
** Microsoft Access uses a file format based on Microsoft Joint Engine Technology (JET)
 +
* Microsoft Office 2007
 +
** Uses the [[ZIP archive]] file format for most of the file formats
 +
*** Microsoft Word uses the [[Word Document (DOCX)]] file format
 +
*** Microsoft Excel uses the [[Excel Spreadsheet (XLSB)]] and [[Excel Spreadsheet (XLSX)]] file formats
 +
*** Microsoft PowerPoint
 +
*** Microsoft Publisher
 +
*** Microsoft Visio
 +
** Microsoft Outlook
 +
** Microsoft Access
  
== [[Windows]] ==
+
==See Also==
 +
*[[Tools:Document Metadata Extraction]]
 +
*[[Media:Compdocfileformat.pdf|Microsoft Compound Document File Format]]
  
See [[Thumbs.db]].
+
==External Links==
  
== [[Windows]] Vista ==
+
===Microsoft.com links===
 +
* [http://msdn.microsoft.com/en-us/library/aa338205.aspx Introducing the Office (2007) Open XML File Formats]
 +
* [http://msdn.microsoft.com/en-us/library/cc313105.aspx Microsoft Office Binary File Format Documents]
 +
* [http://www.microsoft.com/interop/docs/OfficeBinaryFormats.mspx Microsoft Office Binary (doc, xls, ppt) File Formats]
 +
* [http://office.microsoft.com/en-us/products/ha102058151033.aspx Ecma Office Open XML File Formats overview]
 +
* [http://office.microsoft.com/en-us/help/HA100069351033.aspx Introduction to new file name extensions and Open XML Formats]
 +
===Evaluations===
 +
* [http://www.joelonsoftware.com/items/2008/02/19.html Why are the Microsoft Office file formats so complicated? (And some workarounds)]
  
[[Thumbs.db]] no longer exists in Vista. This data has been moved to ''\Users\\AppData\Local\Microsoft\Windows\Explorer''. This directory contains following files:
+
===Wikipedia===
 +
* [http://en.wikipedia.org/wiki/Microsoft_Word Wikipedia article on Microsoft Word]
 +
* [http://en.wikipedia.org/wiki/Object_Linking_and_Embedding Wikipedia article on OLE]
  
* thumbcache_idx.db
+
[[Category:File Formats]]
* thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, and thumbcache_1024.db
+
* thumbcache_sr.db
+
 
+
Thumbnails are stored in ''thumbcache_NN.db'' files in different formats (e.g. [[BMP]]) and can be extracted using [[File Carving | file carving]]. There are several tools that can work with Vista Thumbcache: [http://www.dmthumbs.com/ dmThumbs], [http://www.janusware.com/fetch.php?page=412,2 Thumbs.db Viewer]. Unfortunately, there is no information in the thumbcache that can easily link thumbnails with original files in all cases. One of the ways to link thumbnails with original files is to use Windows Indexer (Windows.edb) database.
+
 
+
[[Windows]] Vista will save thumbnails for files on a mounted encrypted filesystems (except [[Windows Encrypted File System | EFS]]).
+
 
+
== KDE & GNOME ==
+
 
+
KDE and GNOME are popular desktop environments for [[Linux]] and [[UNIX]] platforms. They are storing thumbnails in ''~/.thumbnails''.
+
 
+
Example thumbnail in GNOME:
+
 
+
<pre>
+
$ hachoir-metadata .thumbnails/normal/0d97afdc637ac86d75d13e72172dc77c.png
+
Metadata:
+
- Image width: 128 pixels
+
- Image height: 122 pixels
+
- Bits/pixel: 24
+
- Pixel format: RGB
+
- Compression rate: 1.6x
+
- Compression: deflate
+
- Producer: GNOME::ThumbnailFactory
+
- Comment: Thumb::Image::Width=779
+
- Comment: Thumb::Image::Height=744
+
- Comment: Thumb::URI=file:///media/truecrypt1/123.jpg
+
- Comment: Thumb::MTime=1216153400
+
- MIME type: image/png
+
- Endian: Big endian
+
</pre>
+
 
+
GNOME will save thumbnails for files on mounted encrypted filesystems.
+

Latest revision as of 15:26, 13 January 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Contents

Office versions, applications and file formats

  • pre 95 DOS versions
  • pre 95 Windows versions
    • Microsoft Word 6.0
  • Microsoft Office 95
  • Microsoft Office 97 - 2003
  • Microsoft Office 2007

See Also

External Links

Microsoft.com links

Evaluations

Wikipedia