Posts tagged: #dfir

What thumbcache_*.db files prove in an investigation, how to recover deleted thumbnails, and the caveats to state before a thumbnail goes in a report.

Thumbcache Viewer, Vinetto, forensic suites and browser-based parsing compared: platforms, formats, deleted-entry recovery and file-name mapping.

How Thumbs.db stores thumbnails, original file names and modified times, why old Type 1 images look corrupt, and where modern Windows still creates Thumbs.db.