Revision as of 09:36, 17 April 2017 edit Cherkash (talk \| contribs) Extended confirmed users 30,419 edits m →As forensic evidence: clean up using AWB ← Previous edit		Revision as of 09:36, 17 April 2017 edit undo Cherkash (talk \| contribs) Extended confirmed users 30,419 edits m →As forensic evidence Next edit →
Line 17: Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive. For example, the [[FBI]] used the "thumbs.db" file in 2008 as evidence of viewing depictions of [[child pornography]].<ref>{{cite web \|url=http://news.cnet.com/8301-13578_3-9899151-38.html?tag=mncol;txt\|title=FBI posts fake hyperlinks to snare child porn suspects\|publisher=CBS Interactive\|work=CNET}}</ref> Sarah Morris and Howard Chivers have investigated the forensic artifacts left by the Windows 7 and Linux thumbnail cache and the relationships that could be formed with the remainder of the system in order to corroborate this evidence.<ref>{{cite web \|url=http://www.identatron.co.uk/?page_id=41\|title=Forensic Computing Research "– Identatron\|work=identatron.co.uk}}</ref>{{failed verification\|date=January 2017}} ==See also==

Windows thumbnail cache: Difference between revisions