Windows Thumbnails Cache in Forensics Evidence

What Are Thumbnails?

Thumbnails are small, compressed versions of images that are created by windows operating systems to provide a quick preview of the original open files. Every Windows machine store thumbnail in files like thumbcache.db and thumbs.db.

How Thumbnails Are Used in Forensics

1. Recovering Deleted Images: Even if the original images are deleted, their thumbnails might still be stored in the system. Forensic investigators can extract these thumbnails to get an idea of the deleted content
2. Timeline Reconstruction: Thumbnails often contain metadata, such as the creation date and file path of the original image. This information can help investigators reconstruct the timeline of events
3. Identifying User Activity: By analyzing thumbnails, investigators can determine which images a user has viewed or accessed. This can be crucial in cases involving illegal content
4. Linking Evidence: Thumbnails can be linked back to the original files, even if the files have been moved or renamed. This helps in establishing connections between different pieces of evidence

Example: Windows Thumbcache

In Windows system, the thumbcache.db file stores thumbnails for images viewed in File Explorer. Forensic tools can be used to extract and analyze these thumbnails, providing valuable insights into user activity

Challenges

While thumbnails are useful, they also present challenges:

• Compression Artifacts: Thumbnails are compressed, which can reduce the quality and detail of the images.
• Partial Data: Sometimes, only partial thumbnails are available, making it difficult to get a complete picture.

Tools for Analyzing Thumbnails

Several forensic tools can help extract and analyze thumbnails, such as:

• FTK Imager: A popular tool for creating disk images and extracting data, including thumbnails.
• Thumbcache Viewer: Specifically designed to view and extract thumbnails from thumbcache.db files.

Understanding and utilizing thumbnails can provide crucial evidence in digital forensic investigations, helping to uncover hidden or deleted information.

Finding Thumbnails on a Windows Machine

1. Thumbcache Files: Windows stores thumbnails in thumbcache.db files located in the following directory:
   

   C:\Users\<YourUsername>\AppData\Local\Microsoft\Windows\Explorer\
   

   Replace <YourUsername> with your actual username.

2. Thumbs.db Files: Older versions of Windows (like Windows 7) store thumbnails in thumbs.db files within the directories where the images are located.
   

Extracting Thumbnails Using FTK Imager

1. Download and Install FTK Imager:
   
   • You can download FTK Imager from the AccessData website.
2. Launch FTK Imager:
   
   • Open FTK Imager on your computer.
3. Add Evidence Item:
   
   • Go to File > Add Evidence Item.
   • Select Logical Drive and click Next.
   • Choose the drive where the thumbnails are stored (usually the C: drive) and click Finish.
4. Navigate to the Thumbnails Directory:
   
   • In the Evidence Tree pane, navigate to C:\Users\<YourUsername>\AppData\Local\Microsoft\Windows\Explorer\.
   • You will see various thumbcache_*.db files.
   
   
    
   
5. Export Thumbnails:
   
   • Right-click on the thumbcache_*.db file you want to extract.
   • Select Export Files and choose a destination folder to save the extracted thumbnails.
   
    
   
   
   
   
6. Analyze Thumbnails:
   
   • You can use tools like Thumbcache Viewer to open and analyze the extracted thumbcache.db files.
   
    
   

You can see we discover that user open the "AUTOPSY" application.