Skip to content
Thumbcache Parser

New — recover thumbnails from slack space

The thumbcache viewer built for forensics.

Open thumbcache_*.db, iconcache_*.db and Thumbs.db files to see every cached thumbnail — including ones recovered from deleted entries.

Parsed in your browser with WebAssembly. Nothing is uploaded.

Drop thumbcache_*.db, iconcache_*.db, Thumbs.db — or a whole folder or ZIP

Folders and ZIPs (e.g. a Disk Image Parser export) are scanned for cache files automatically.

Synthetic thumbnail cache + Windows Search index from a fictional intrusion — no real data. Try the time range: select the deleted screenshot (10:12:04 UTC) and click “Around selection”.

How do I get these files?

How to get your data

Never collected a thumbnail cache? Take the first method that fits: each one produces a folder or ZIP you can drop straight into the parser above.

  1. 1Collect the caches with one command
  2. 2Drop the folder or ZIP above
  3. 3Parsed in your browser — nothing is uploaded

Live Windows machine: one PowerShell paste

Run in PowerShell as Administrator (Windows 8, 10 or 11, system drive C:). Built-in tools only: a temporary shadow copy of C: gets past the files Explorer keeps locked, and is deleted at the end.

PowerShell (Administrator)
$out = 'C:\triage\thumbcache'
New-Item -ItemType Directory -Force -Path $out | Out-Null
$r = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{ Volume = 'C:\' }
$vss = Get-CimInstance Win32_ShadowCopy | Where-Object ID -eq $r.ShadowID
cmd /c mklink /d C:\triage\vss "$($vss.DeviceObject)\"
$exp = 'AppData\Local\Microsoft\Windows\Explorer'
Get-ChildItem C:\triage\vss\Users -Directory | ForEach-Object {
  if (Test-Path "$($_.FullName)\$exp") {
    robocopy "$($_.FullName)\$exp" "$out\Users\$($_.Name)\$exp" thumbcache_*.db iconcache_*.db /B /R:0 /W:0 /NP /NDL /NJH /NJS
  }
}
$idx = 'ProgramData\Microsoft\Search\Data\Applications\Windows'
robocopy "C:\triage\vss\$idx" "$out\$idx" Windows.edb Windows.db *.log *.chk /B /R:0 /W:0 /NP /NDL /NJH /NJS
cmd /c rmdir C:\triage\vss
Remove-CimInstance -InputObject $vss

Result: C:\triage\thumbcache holds every profile's thumbcache_*.db and iconcache_*.db under Users\<name>\…, plus the Windows Search index. Click “Choose folder” above and select it, or drag it onto the drop zone.

Gotchas

  • Don't drag the files out in Explorer: thumbcache_*.db are locked while explorer.exe runs. Use a shadow copy (the Quickest command) or a triage tool — both need administrator rights.
  • Collect early: Disk Cleanup's Thumbnails option and cache rebuilds wipe the caches. Older shadow copies may still hold thumbnails purged from the live files.
  • The search index is read as found; its transaction logs are not replayed. If paths are missing, run esentutl /r MSS on a copy of Windows.edb and its logs (the commands collect them).
  • Vista → Windows 11
  • iconcache
  • Thumbs.db + Type 1
  • Slack carving
  • MD5 · SHA-256
  • No upload
cache size classes decoded
14
every Windows thumbcache version
Vista → 11
uploaded — it all runs locally
0 bytes

Features

Everything an examiner needs from a thumbnail cache

From a single thumbcache_256.db to a whole triage collection — decoded, recovered and report-ready in seconds.

  • Recover what was deleted

    Walks the entry chain, then carves the whole file for CMMM entries. Thumbnails left in slack space are recovered and flagged.

  • Every Windows version

    thumbcache and iconcache from Vista to Windows 11, including all Windows 8 header variants and every size class.

  • Private by design

    A Rust parser compiled to WebAssembly runs in a worker on your machine. No upload, no account, works offline once loaded.

  • Evidence-grade exports

    MD5 and SHA-256 per thumbnail, hashes of each source file, and an HTML report, CSV, JSON or a complete evidence ZIP.

  • Drop the whole collection

    Folders and ZIPs are scanned recursively. Files are attributed to their user profile, including Disk Image Parser exports.

  • Legacy Thumbs.db

    Catalog names and modified times from XP-era Thumbs.db, and Windows 98/2000 Type 1 thumbnails rebuilt into viewable images.

Workflow

How it works

  1. 01

    Collect

    Copy the Explorer cache folder with KAPE, FTK Imager or a shadow copy — or export it from a disk image.

  2. 02

    Drop

    Drop files, a folder or a ZIP. Every entry is decoded in your browser, recovered ones are flagged.

  3. 03

    Report

    Filter, inspect and export the thumbnails with their hashes as an HTML report, CSV or evidence ZIP.

Thumbcache Parser is a free, cross-platform thumbcache viewer for digital forensics. Windows keeps a thumbnail of pictures, videos and documents that were browsed in Explorer, and those thumbnails often outlive the original files. Drop the cache files (or a whole collected folder or ZIP) to browse every thumbnail, its cache ID and hashes, recover entries left in slack space, and export an evidence-ready HTML, CSV or ZIP report. It runs entirely locally, so it is safe for sensitive casework.

Guides

Thumbnail cache guides

thumbcache_*.db file format: CMMM header and entry layout
Byte-level layout of Windows thumbcache and iconcache databases from Vista to Windows 11: file header, per-version cache types and the cache entry structure.
thumbcachefile formatbinary formatwindows internals
Thumbcache forensics: evidence from Windows thumbnail caches
What thumbcache_*.db files prove in an investigation, how to recover deleted thumbnails, and the caveats to state before a thumbnail goes in a report.
thumbcachedfirwindows artifactsthumbnail cache
Thumbcache Viewer alternatives compared
Thumbcache Viewer, Vinetto, forensic suites and browser-based parsing compared: platforms, formats, deleted-entry recovery and file-name mapping.
thumbcachetoolsdfirthumbcache viewer

FAQ

Frequently asked questions

How do I open a thumbcache_*.db file?

Drop it on the parser above, or choose the whole Explorer folder. Every entry is decoded in your browser and shown as a thumbnail grid with its cache ID, dimensions, offset and MD5/SHA-256. Windows Vista, 7, 8, 8.1, 10 and 11 caches are supported.

Can deleted pictures still appear in the thumbnail cache?

Yes. Deleting a file does not remove its thumbnail from thumbcache_*.db, and freed cache entries often stay intact in slack space. The parser signature-scans the whole file and flags recovered entries in red.

Is it safe to load evidence here?

The files are read and parsed locally with WebAssembly in a background worker; no bytes are sent to a server. You can confirm it in your browser's network tab, or use the site offline once it has loaded.

Does it support Thumbs.db?

Yes — Windows XP/2000/ME Thumbs.db with its Catalog (original file names and modified times), Vista+ Thumbs.db written on network shares, and the older Type 1 thumbnails, which are rebuilt into viewable images.

How do I find which file a thumbnail belongs to?

thumbcache entries are keyed by a 64-bit cache ID, not a file name. Windows Search stores the same ID as System_ThumbnailCacheId next to the file's path. Drop Windows.edb (or Windows.db on Windows 11) alongside the caches and every indexed thumbnail is labelled with its original path, name, size and modified time.

Develop your first cache

Drop a thumbcache_*.db, a Thumbs.db or a whole triage ZIP — thumbnails appear in seconds, nothing leaves your machine.

Open a cache