Revision as of 14:04, 19 June 2019 edit Ahunt (talk \| contribs) Autopatrolled, Extended confirmed users, Page movers, Pending changes reviewers, Rollbackers 229,521 edits m →As forensic evidence: ref spacing ← Previous edit		Revision as of 14:04, 19 June 2019 edit undo Ahunt (talk \| contribs) Autopatrolled, Extended confirmed users, Page movers, Pending changes reviewers, Rollbackers 229,521 edits m →As forensic evidence: ref spacing Next edit →
Line 17: Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive.<ref>{{cite web \|url=http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1169&context=amcis2014\|title=Forensic Analysis of Windows Thumbcache files\|publisher=AISEL\|work=University of South Australia}}</ref> For example, the [[FBI]] used the "thumbs.db" file in 2008 as evidence of viewing depictions of [[child pornography]].<ref>{{cite web \|url=http://news.cnet.com/8301-13578_3-9899151-38.html?tag=mncol;txt\|title=FBI posts fake hyperlinks to snare child porn suspects\|publisher=CBS Interactive\|work=CNET}}</ref> In 2013, research was conducted that focused on the Digital Forensic implications of thumbnail caches and recovering partial thumbnail cache files. It identified that whilst there is a standard definition of a thumbnail cache the structure and forensic artifacts recoverable from them varies significantly between operating systems. The work also showed that the thumbcache_256.db contains non-standard thumbnail cache records which can store interesting data such as network place names and allocated drive letters. <ref>[https://core.ac.uk/download/pdf/17168934.pdf], Morris </ref><ref>[http://www.identatron.co.uk/research_2011.html], Morris & Chivers </ref> ==See also==

Windows thumbnail cache: Difference between revisions