OSForensics™ provides a viewer capable of displaying image thumbnails stored in the Window's thumbnail cache database. When a user opens Windows Explorer to browse the contents of folders, Windows automatically saves a thumbnail of the files in the thumbnail cache database for quick viewing at a later time. This can be useful for forensics purposes especially for cases where even though the user has deleted the original image file, the thumbnail of the image still remains in the thumbnail cache.
The Thumbnail Cache Viewer is capable of displaying thumbnails stored in the following files:
- thumbcache_idx.db
- thumbcache_16.db
- thumbcache_32.db
- thumbcache_48.db
- thumbcache_96.db
- thumbcache_256.db
- thumbcache_1024.db
- thumbcache_1600.db
- iconcache_idx.db
- iconcache_16.db
- iconcache_32.db
- iconcache_48.db
- iconcache_96.db
- iconcache_256.db
- iconcache_1024.db
- iconcache_1600.db
- ehthumbs_vista.db
- ehthumbs.db
- thumbs.db
