Thumbnails
From Forensics Wiki
|
Please help to improve this article by expanding it.
|
Thumbnails are reduced-size versions of pictures, serving the same role for images as a normal text index does for words.
Contents |
Windows
See Thumbs.db.
Windows Vista
See Vista thumbcache
Thumbs.db no longer exists in Vista. This data has been moved to \Users\\AppData\Local\Microsoft\Windows\Explorer
Windows Vista will save thumbnails for files on mounted encrypted file systems (except EFS).
KDE & GNOME
KDE and GNOME are popular desktop environments for Linux and UNIX platforms. They are storing thumbnails in ~/.thumbnails.
Example thumbnail in GNOME:
$ hachoir-metadata .thumbnails/normal/0d97afdc637ac86d75d13e72172dc77c.png Metadata: - Image width: 128 pixels - Image height: 122 pixels - Bits/pixel: 24 - Pixel format: RGB - Compression rate: 1.6x - Compression: deflate - Producer: GNOME::ThumbnailFactory - Comment: Thumb::Image::Width=779 - Comment: Thumb::Image::Height=744 - Comment: Thumb::URI=file:///media/truecrypt1/123.jpg - Comment: Thumb::MTime=1216153400 - MIME type: image/png - Endian: Big endian
GNOME will save thumbnails for files on mounted encrypted filesystems.
Example thumbnail in KDE:
$ hachoir-metadata .thumbnails/normal/2e4bc7bf05bd57e19c6f2a01cf4a8f71.png Metadata: - Image width: 96 pixels - Image height: 128 pixels - Bits/pixel: 24 - Pixel format: RGB - Compression rate: 1.6x - Compression: deflate - Producer: KDE Thumbnail Generator - Comment: Thumb::MTime=1236952299 - Comment: Thumb::Mimetype=image/jpeg - Comment: Thumb::Size=827837 - Comment: Thumb::URI=file:///home/fuf/10032009(002).jpg - MIME type: image/png - Endian: Big endian