What is the signature of a thumbcache file?

The ASCII bytes CMMM (43 4D 4D 4D) at offset 0. Every cache entry inside the file starts with the same four bytes. The index file thumbcache_idx.db uses IMMM instead.

How do I tell which Windows version wrote a thumbcache file?

Read the 32-bit format version at offset 4: 0x14 is Vista, 0x15 is Windows 7, 0x1A, 0x1C and 0x1E are Windows 8 builds, 0x1F is Windows 8.1 and 0x20 is Windows 10 and 11.

What image formats are stored in thumbcache?

BMP, JPEG and PNG, stored whole. Windows 10 and 11 mostly store 32-bit BMPs, while older versions and wide or EXIF caches often use JPEG or PNG. Detect the format from the image's own magic bytes.

thumbcache_*.db file format: CMMM header and entry layout

This is a reference for the on-disk structure of Windows Explorer's thumbnail and icon caches (thumbcache_*.db, iconcache_*.db). The layout is undocumented by Microsoft. What follows is consistent with public research and open-source parsers such as Vinetto and Thumbcache Viewer, and is what the Thumbcache Parser implements. All integers are little-endian.

File header

Offset	Size	Field
0	4	Signature `CMMM`
4	4	Format version
8	4	Cache type (index into the table below)

What follows depends on the version:

Version	Written by	Offset 12	Offset 16	Offset 20	Offset 24
`0x14`	Vista	first entry	available entry	entry count	–
`0x15`	7	first entry	available entry	entry count	–
`0x1A`	8	first entry	available entry	entry count	–
`0x1C`	8 (v2)	reserved	first entry	available entry	entry count
`0x1E`	8 (v3)	reserved	first entry	available entry	–
`0x1F`	8.1	reserved	first entry	available entry	–
`0x20`	10 / 11	reserved	first entry	available entry	–

First entry is the offset of the first cache entry. Available entry marks the start of free space: entries past it were freed, but their bytes are often still intact. A robust parser should check that the first-entry offset actually points at CMMM, and fall back to scanning if not.

Cache types

The cache type number maps to the file's size class, and the table changed between releases:

Version	0	1	2	3	4	5	6	7	8	9	10	11	12	13
Vista / 7	32	96	256	1024	sr
8 (all)	16	32	48	96	256	1024	sr	wide	exif
8.1	16	32	48	96	256	1024	1600	sr	wide	exif	wide_alternate
10 / 11	16	32	48	96	256	768	1280	1920	2560	sr	wide	exif	wide_alternate	custom_stream

Cache entry

Entries follow each other back to back. The header is 48 bytes on Windows 7 and 56 bytes on Vista and Windows 8+:

Field	Vista	7	8 → 11
Signature `CMMM`	0	0	0
Entry size (whole entry)	4	4	4
Entry hash / cache ID (u64)	8	8	8
Source extension (4 × UTF-16)	16	–	–
Identifier size	24	16	16
Padding size	28	20	20
Data size	32	24	24
Width	–	–	28
Height	–	–	32
Unknown	36	28	36
Data checksum (u64)	40	32	40
Header checksum (u64)	48	40	48

After the header come the identifier (UTF-16LE, usually the cache ID written as 16 hex digits), the padding, and the image data. The next entry starts at offset + entry size.

Entries with a data size of 0 are common. They are placeholders for items whose thumbnail was not generated or was dropped. They still carry a cache ID and so are worth keeping in a timeline.

Sanity checks when carving

When scanning for CMMM outside the live chain, reject a candidate unless:

the entry size is at least the header length and fits in the file;
header + identifier + padding + data ≤ entry size;
the identifier size is even and reasonably small.

These checks keep false positives rare, because CMMM does not occur often in image data.

The image data

The payload is a complete image file: BM (BMP), FF D8 FF (JPEG) or 89 50 4E 47 (PNG). Hash these bytes as-is for reporting. Windows 10 and 11 mostly store 32-bit top-down or bottom-up BMPs, which every modern browser can display.

thumbcache_idx.db

The index (IMMM) maps cache IDs to entry offsets in each size database, along with flags. It holds no images, and its layout varies more between builds. It is most useful for confirming that an ID was once cached even after the size databases were cleaned.