Skip to content
Thumbcache Parser

Thumbnail Cache Forensics Guides

Practitioner guides to Windows thumbnail caches — thumbcache_*.db internals, Thumbs.db, recovering deleted thumbnails and mapping cache IDs back to files.

thumbcache_*.db file format: CMMM header and entry layout
Byte-level layout of Windows thumbcache and iconcache databases from Vista to Windows 11: file header, per-version cache types and the cache entry structure.
thumbcachefile formatbinary formatwindows internals
Thumbcache forensics: evidence from Windows thumbnail caches
What thumbcache_*.db files prove in an investigation, how to recover deleted thumbnails, and the caveats to state before a thumbnail goes in a report.
thumbcachedfirwindows artifactsthumbnail cache
Thumbcache Viewer alternatives compared
Thumbcache Viewer, Vinetto, forensic suites and browser-based parsing compared: platforms, formats, deleted-entry recovery and file-name mapping.
thumbcachetoolsdfirthumbcache viewer
Thumbs.db forensics: Catalog, Type 1 images and shares
How Thumbs.db stores thumbnails, original file names and modified times, why old Type 1 images look corrupt, and where modern Windows still creates Thumbs.db.
thumbs.dbdfirwindows xpole compound file