Skip to content
Thumbcache Parser

New — recover thumbnails from slack space

The thumbcache viewer built for forensics.

Open thumbcache_*.db, iconcache_*.db and Thumbs.db files to see every cached thumbnail — including ones recovered from deleted entries.

Parsed in your browser with WebAssembly. Nothing is uploaded.

Drop thumbcache_*.db, iconcache_*.db, Thumbs.db — or a whole folder or ZIP

Folders and ZIPs (e.g. a Disk Image Parser export) are scanned for cache files automatically.

  • Vista → Windows 11
  • iconcache
  • Thumbs.db + Type 1
  • Slack carving
  • MD5 · SHA-256
  • No upload
cache size classes decoded
14
every Windows thumbcache version
Vista → 11
uploaded — it all runs locally
0 bytes

Features

Everything an examiner needs from a thumbnail cache

From a single thumbcache_256.db to a whole triage collection — decoded, recovered and report-ready in seconds.

  • Recover what was deleted

    Walks the entry chain, then carves the whole file for CMMM entries. Thumbnails left in slack space are recovered and flagged.

  • Every Windows version

    thumbcache and iconcache from Vista to Windows 11, including all Windows 8 header variants and every size class.

  • Private by design

    A Rust parser compiled to WebAssembly runs in a worker on your machine. No upload, no account, works offline once loaded.

  • Evidence-grade exports

    MD5 and SHA-256 per thumbnail, hashes of each source file, and an HTML report, CSV, JSON or a complete evidence ZIP.

  • Drop the whole collection

    Folders and ZIPs are scanned recursively. Files are attributed to their user profile, including Disk Image Parser exports.

  • Legacy Thumbs.db

    Catalog names and modified times from XP-era Thumbs.db, and Windows 98/2000 Type 1 thumbnails rebuilt into viewable images.

Workflow

How it works

  1. 01

    Collect

    Copy the Explorer cache folder with KAPE, FTK Imager or a shadow copy — or export it from a disk image.

  2. 02

    Drop

    Drop files, a folder or a ZIP. Every entry is decoded in your browser, recovered ones are flagged.

  3. 03

    Report

    Filter, inspect and export the thumbnails with their hashes as an HTML report, CSV or evidence ZIP.

Where to find thumbnail caches

Per-user caches on Vista and later; per-folder Thumbs.db on older systems and network shares. The Windows Search index links cache IDs back to file paths.

  • thumbcache / iconcacheVista+%LOCALAPPDATA%\Microsoft\Windows\Explorer\
  • Thumbs.db (local)98–XP<any folder>\Thumbs.db
  • Thumbs.db (shares)Vista+\\<server>\<share>\…\Thumbs.db
  • Search index (ESE)Vista–10%ProgramData%\Microsoft\Search\Data\Applications\Windows\Windows.edb
  • Search index (SQLite)Win 11%ProgramData%\Microsoft\Search\Data\Applications\Windows\Windows.db

How to collect them

  • thumbcache_*.db are locked by explorer.exe on a live system: collect them with KAPE (ThumbCache target), FTK Imager or from a Volume Shadow Copy rather than copying them in Explorer.
  • From a disk image, Disk Image Parser collects them in one click with its Thumbnail cache preset — drop the exported ZIP here as is.
  • Collect every size (16 to 2560, sr, wide, exif, idx) and the iconcache_*.db files: a thumbnail may survive in one size after being purged from another.

Read the thumbcache forensics guide →

Thumbcache Parser is a free, cross-platform thumbcache viewer for digital forensics. Windows keeps a thumbnail of pictures, videos and documents that were browsed in Explorer, and those thumbnails often outlive the original files. Drop the cache files (or a whole collected folder or ZIP) to browse every thumbnail, its cache ID and hashes, recover entries left in slack space, and export an evidence-ready HTML, CSV or ZIP report. It runs entirely locally, so it is safe for sensitive casework.

Guides

Thumbnail cache guides

thumbcache_*.db file format: CMMM header and entry layout
Byte-level layout of Windows thumbcache and iconcache databases from Vista to Windows 11: file header, per-version cache types and the cache entry structure.
thumbcachefile formatbinary formatwindows internals
Thumbcache forensics: evidence from Windows thumbnail caches
What thumbcache_*.db files prove in an investigation, how to recover deleted thumbnails, and the caveats to state before a thumbnail goes in a report.
thumbcachedfirwindows artifactsthumbnail cache
Thumbcache Viewer alternatives compared
Thumbcache Viewer, Vinetto, forensic suites and browser-based parsing compared: platforms, formats, deleted-entry recovery and file-name mapping.
thumbcachetoolsdfirthumbcache viewer

FAQ

Frequently asked questions

How do I open a thumbcache_*.db file?

Drop it on the parser above, or choose the whole Explorer folder. Every entry is decoded in your browser and shown as a thumbnail grid with its cache ID, dimensions, offset and MD5/SHA-256. Windows Vista, 7, 8, 8.1, 10 and 11 caches are supported.

Can deleted pictures still appear in the thumbnail cache?

Yes. Deleting a file does not remove its thumbnail from thumbcache_*.db, and freed cache entries often stay intact in slack space. The parser signature-scans the whole file and flags recovered entries in red.

Is it safe to load evidence here?

The files are read and parsed locally with WebAssembly in a background worker; no bytes are sent to a server. You can confirm it in your browser's network tab, or use the site offline once it has loaded.

Does it support Thumbs.db?

Yes — Windows XP/2000/ME Thumbs.db with its Catalog (original file names and modified times), Vista+ Thumbs.db written on network shares, and the older Type 1 thumbnails, which are rebuilt into viewable images.

How do I find which file a thumbnail belongs to?

thumbcache entries are keyed by a 64-bit cache ID, not a file name. Windows Search stores the same ID as System_ThumbnailCacheId next to the file's path. Drop Windows.edb (or Windows.db on Windows 11) alongside the caches and every indexed thumbnail is labelled with its original path, name, size and modified time.

Develop your first cache

Drop a thumbcache_*.db, a Thumbs.db or a whole triage ZIP — thumbnails appear in seconds, nothing leaves your machine.

Open a cache