DM Thumbs logo

dmThumbs

Think DM Thumbs forensics
  • thumbcache_idx.db
  • thumbcache_1024.db
  • thumbcache_256.db
  • thumbcache_96.db
Contact Us
Thumbs db You are here Download DM Thumbs Trial DM Thumbs FAQ Buy DM Thumbs Now  
         
 

 

Vista Thumbcaches

 

Vista no longer uses the Thumbs.db files found in earlier versions of Windows. Instead Vista employs a central cache of thumbnail images which is used throughout the computer.

Various sizes of thumbnail image are stored ranging from 32 pixels through to 1024 pixels. The different size images are stored in separate caches, such as thumbcache_256.db. A central index, thumbcache_idx.db, facilitates access to the thumbnails in the individual caches.

 

thumbcache_idx.db

 

The thumbcache_idx.db index file contains file references for thumbnails cached on a Vista computer. Under each reference it stores the location of thumbnails in the individual size based caches. It also stores date and time data which is useful for forensic analysis.

The thumbcaches are not only used for the storing of images but are used for other purposes by the operating system. As a result the thumbcache entries may not contain image data.

 

thumbcache_1024.db

 

The thumbcache_1024.db file contains cached images up to 1024 x 1024 in size. As such the file is not only useful for forensic analysis but may also provide reasonable quality images when photos or other images have been lost or deleted. DM Thumbs can also be used for photo recovery.

 

thumbcache_256.db

 

The thumbcache_256.db file is used to contain other data for file system reference purposes. This means that a thumbcache_256.db file will contain many entries which do not contain image data. DM Thumbs will show a marker image when no image data is available but will still display data stored in respect of that entry.

 

A forensic note

 

In situations when a live copy of thumbcache files is required, beware! If using Windows Explorer it can clear the thumbcaches of all their entries before the copy command is complete. It appears that this is generally on 2nd and subsequent copies.

 
Where to find thumbcaches :
You can find the thumbcaches under the Windows Explorer section in Local AppData. DM Thumbs should default to this location when run on Vista.
Explorer folder under AppData
 
       
       
  GreenSpot Technologies Ltd © 2015