Skip to content

Analyse and Export Thumbnail Caches

Start with a question, not an image gallery: Does this cache contain a preview consistent with the reported document or picture, and what source context can be preserved or corroborated?

Thumbs Viewer workflow

Legacy or folder-level database

  1. Select File → Open, then choose the verified working copy of Thumbs.db or another supported database.
  2. Confirm the populated table is consistent with the expected database family and record the displayed System value.
  3. Sort or review Filename, Entry Size, Sector Index, and Date Modified (UTC) without relabelling any field.
  4. Select an entry to preview it. Use + or - to zoom and Home to centre the image where useful.
  5. Save the selected entry or export the list to CSV from the main menu. Export to the case output folder, never the source folder.
  6. Hash the exported image and CSV, and link them to the source database hash in the examination notes.

The interface also supports mapping local files to hashed filenames for applicable databases. Treat a recovered or mapped name as a lead and record how the mapping was performed.

# Open a database
& 'C:\Tools\Thumbs Viewer\thumbs_viewer.exe' 'E:\Cases\SUSA-083\working\Thumbs.db'

# Save thumbnails or export a CSV
& 'C:\Tools\Thumbs Viewer\thumbs_viewer.exe' -o 'E:\Cases\SUSA-083\exports\thumbs' 'E:\Cases\SUSA-083\working\Thumbs.db'
& 'C:\Tools\Thumbs Viewer\thumbs_viewer.exe' -c 'E:\Cases\SUSA-083\exports\thumbs.csv' 'E:\Cases\SUSA-083\working\Thumbs.db'

Thumbcache Viewer workflow

Per-user cache database

  1. Select File → Open, then choose a verified thumbcache_*.db or iconcache_*.db working copy.
  2. Retain the database name because it provides cache-family or size context; do not assume thumbnail pixels exactly equal the suffix.
  3. Hide zero-byte entries only as a documented view filter. Preserve the unfiltered row count first.
  4. Verify CRC-64 header and data checksums when relevant. A mismatch is a condition to report, not a reason to silently discard the row.
  5. Select entries to preview them and record the cache-entry hash, offsets, sizes, filename field, dimensions, checksums, and system value that support the selected observation.
  6. Export selected entries and CSV to controlled output. Hash each retained output.

Mapping entry hashes can use files or Windows Search data, but the method has environment and version dependencies. Directory scanning should be performed on the same system that generated the database. Windows Search mapping may provide paths, timestamps, or snippets; retain the mapping source and treat the result as corroboration rather than content proof.

# GUI command-line examples
& 'C:\Tools\Thumbcache Viewer\thumbcache_viewer.exe' 'E:\Cases\SUSA-083\working\thumbcache_256.db'
& 'C:\Tools\Thumbcache Viewer\thumbcache_viewer.exe' -o 'E:\Cases\SUSA-083\exports\thumbcache' 'E:\Cases\SUSA-083\working\thumbcache_256.db'
& 'C:\Tools\Thumbcache Viewer\thumbcache_viewer.exe' -c 'E:\Cases\SUSA-083\exports\thumbcache.csv' 'E:\Cases\SUSA-083\working\thumbcache_256.db'

# Optional dedicated command-line build: reports plus extraction
& 'C:\Tools\Thumbcache Viewer\thumbcache_viewer_cmd.exe' -o 'E:\Cases\SUSA-083\exports\batch' -w -c -z -t 'E:\Cases\SUSA-083\working\thumbcache_256.db'

Interpret one record defensibly

Observe

State what the selected database and tool displayed: entry identifier, cached image content, sizes, checksum state, and exact labelled metadata.

Corroborate

Seek the original path or identity in Windows Search, $MFT, USN Journal, LNK files, Jump Lists, ShellBags, application records, or other case evidence.

Conclude

Use bounded wording: the cache contained a preview consistent with the described content. State confidence, mapping method, gaps, and alternative causes of cache creation.

Example case note

thumbcache_256.db from the acquired profile of LAB\alex contained cache entry 7f3a…91c2, which Thumbcache Viewer rendered as a preview consistent with a blue building-access diagram. CRC-64 verification reported no mismatch. The cache record supports prior generation or retention of this preview in that profile context; it does not alone identify the original path, viewing action, actor, or time. Search and file-system artefacts should be examined next.

Evidence package

  • source image, host, user or folder context, and original database path;
  • acquisition-copy and working-copy database SHA-256 values;
  • viewer name, version, architecture, executable hash, and settings;
  • selected entry metadata using the interface's exact field labels;
  • exported image, CSV or report filenames, byte sizes, and SHA-256 values;
  • checksum or parse warnings, zero-byte filtering, mapping method, and errors;
  • observed result, interpretation, limitations, corroboration, and next step.
PreviousInstall and openNextPractise in Hands-on Labs