Thumbcache Viewer alternatives compared

Several tools read Windows thumbnail caches, and they have different strengths. This is a fair comparison from someone who built one of them: pick the one that fits your case, and verify important findings with a second tool.

Thumbcache Viewer (Windows)

Eric Kutcher's Thumbcache Viewer is the long-standing free reference for thumbcache_*.db. His companion Thumbs Viewer handles Thumbs.db.

• Windows GUI, very mature, handles every version from Vista to 11.
• Can load the Windows Search database (Windows.edb) and map cache IDs to original file paths, its biggest advantage.
• Can export thumbnails and reports.
• Windows-only; on macOS or Linux you need a VM or Wine.

Vinetto (Linux / cross-platform, CLI)

Vinetto is a Python command-line tool (GPL-3):

• parses Thumbs.db (including the old Type 1 images), thumbcache_*.db and can cross-reference Windows.edb through libesedb;
• file, directory, recursive and "automatic" modes, the last of which finds profiles on a mounted Windows partition;
• HTML report, symlinks from original names, MD5 hashes;
• good for scripted pipelines on Linux forensic workstations.

Commercial suites

Magnet AXIOM, X-Ways Forensics, EnCase, FTK and similar suites parse thumbnail caches as part of full-case processing, with categorisation and hash-set matching. If you already process the image in one of them, use it. Their advantage is correlation with everything else in the case.

Thumbcache Parser (browser)

Thumbcache Parser is the tool on this site:

• runs in any modern browser on any OS; the Rust parser is compiled to WebAssembly and nothing is uploaded;
• thumbcache_*.db and iconcache_*.db (Vista → 11), Thumbs.db including Type 1 reconstruction, ehthumbs.db;
• walks the entry chain and signature-carves the whole file, flagging slack and carved entries;
• takes whole folders or ZIP archives (for example a Disk Image Parser triage export) and attributes each file to its user profile;
• per-thumbnail MD5 and SHA-256, and a self-contained HTML report, CSV, JSON or an evidence ZIP;
• maps cache IDs to original paths from the Windows Search index, both Windows.edb (ESE, Vista → 10) and Windows 11's Windows.db (SQLite). The index is streamed page by page, so multi-gigabyte databases work.

It reads the ESE database as found and does not replay transaction logs, so run esentutl /r on a copy of a dirty Windows.edb first if it looks incomplete.

Which one?

Whatever you use, record the tool and version in your notes and hash the source files before and after.