Windows thumbnail cache: Difference between revisions

Revision as of 11:31, 15 March 2020

Revision as of 22:47, 14 January 2021

Line 1:

On [[Microsoft Windows]] [[operating system]]s, starting with the [[Internet Explorer 4]] Active Desktop Update for Windows 95 and 98,<ref name=PCWorld>{{cite web |url=http://www.pcworld.com/article/13357/windows_tips.html|title=Windows Tips|date=19 October 1999|work=PCWorld}}</ref><ref name=AccessData>[http://accessdata.com/media/en_us/print/papers/wp.Thumbs_DB_Files.en_us.pdf Thumbs.db files forensic issues: AccessData Corporation]</ref>, a '''thumbnail cache''' is used to store [[thumbnail]] images for [[Windows Explorer]]'s thumbnail view. This speeds up the display of images as these smaller images do not need to be recalculated every time the user views the folder.

==Purpose==

Line 17:

Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive.<ref>{{cite web |url=http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1169&context=amcis2014|title=Forensic Analysis of Windows Thumbcache files|publisher=AISEL|work=University of South Australia}}</ref> For example, the [[FBI]] used the "thumbs.db" file in 2008 as evidence of viewing depictions of [[child pornography]].<ref>{{cite web|url=http://news.cnet.com/8301-13578_3-9899151-38.html?tag=mncol;txt|title=FBI posts fake hyperlinks to snare child porn suspects|publisher=CBS Interactive|work=CNET|archive-url=https://web.archive.org/web/20121105184141/http://news.cnet.com/8301-13578_3-9899151-38.html|archive-date=November 5, 2012}}</ref>

In 2013, research was conducted that focused on the Digital Forensic implications of thumbnail caches and recovering partial thumbnail cache files. It identified that whilst there is a standard definition of a thumbnail cache the structure and forensic artifacts recoverable from them varies significantly between operating systems. The work also showed that the thumbcache_256.db contains non-standard thumbnail cache records which can store interesting data such as network place names and allocated drive letters.<ref>[https://core.ac.uk/download/pdf/17168934.pdf], Morris </ref><ref>[http://www.identatron.co.uk/research_2011.html], Morris & Chivers </ref>

==See also==