Skip to content

Install and Open the Thumbnail Cache Viewers

Download the two projects separately because they use different executables and parse different database families. Record the download source, filename, architecture, version, download time, and SHA-256 before extracting either archive.

Current release details can change

The project pages list separate 32-bit and 64-bit downloads and the Visual C++ 2008 runtime requirement. Verify the current release and requirements on the authoritative pages when you build or update a workstation.

Prepare Thumbs Viewer

  1. Download Thumbs Viewer from the project page.
  2. Extract the archive to C:\Tools\Thumbs Viewer.
  3. Record the extracted executable's version and SHA-256.
  4. Double-click thumbs_viewer.exe to launch the application.

The empty table includes Filename, Entry Size, Sector Index, Date Modified (UTC), and System. The table remains empty until you open a supported database.

Screenshot: Download Thumbs Viewer and extract the contents to C:\Tools\Thumbs Viewer

Preserved download and extraction screenshot.

Screenshot: Double-click thumbs_viewer to launch the application

Thumbs Viewer opened and ready for a working-copy database.

Prepare Thumbcache Viewer

Screenshot: Download Thumbcache Viewer (GUI) and extract the contents to C:\Tools\Thumbcache Viewer

Preserved download and extraction screenshot.
  1. Download Thumbcache Viewer (GUI) from the project page.
  2. Select the architecture appropriate for the examination workstation.
  3. Extract it to C:\Tools\Thumbcache Viewer.
  4. Record the executable's version and SHA-256.
  5. Double-click thumbcache_viewer.exe to launch the application.

Its table exposes cache-entry offsets, sizes, data offsets and sizes, checksums, entry hashes, filenames, dimensions, and system information where available.

Screenshot: Double-click thumbcache_viewer to launch the application

Thumbcache Viewer opened and ready for a verified working copy.

Establish the examination boundary

Source

Record the acquired image, host, user or directory, original database path, collection method, and source SHA-256.

Working copy

Copy the database to controlled storage, calculate SHA-256 independently, and confirm it matches the protected copy before opening it.

Output

Create a case-labelled export folder outside the source. Never export recovered images back into an evidence directory.

Get-FileHash -Algorithm SHA256 'E:\Cases\SUSA-083\source\Thumbs.db'
Get-FileHash -Algorithm SHA256 'E:\Cases\SUSA-083\working\Thumbs.db'

Do not examine the live cache in place

A live user's cache may be locked or changed by Windows and applications. Use an authorised acquisition and a verified working copy; preserve the acquisition copy unchanged.

Opening check

If the source is named… Open it with… Preserve this context
Thumbs.db, ehthumbs.db, Image.db, or another listed legacy database Thumbs Viewer Original folder and volume context
thumbcache_256.db, another thumbcache_*.db, or iconcache_*.db Thumbcache Viewer User profile, cache family, and related databases
PreviousThumbnail Cache Viewers overviewNextAnalyse and export