O'Reilly logo

Practical Windows Forensics by Konstantin Sapronov, Ayman Shaaban

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Windows Thumbs DB

When the user uses the Thumbnails or Filmstrip views from the Windows folder viewing options, a small thumbnail version of the pictures will be created and stored in a single file. This file is located in the same directory as the pictures in Windows XP and named Thumbs.db. The Thumbs.db file has a thumbnail version of the existing and also deleted pictures. Thumbs.db is a hidden file, and usually the user ignores it:

Windows Thumbs DB

Figure 5: Files viewing options

If the user has deleted the pictures but hasn't delete the Thumbs.db file, it will be possible to recover the thumbnail version of the pictures deleted from that directory, which provide ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required