NII Consulting | Kush Wadhwa | 06.22.07
Importance of “thumbs.db” in digital forensic world
Fascinating piece from a forensics expert on the use of the thumbs.db file.
“There is a file with a name “thumbs.db” which is automatically generated by Windows XP whenever user views the folder or image in thumbs view or in filmstrip view… Thumbs.db contains a copy of each of the tiny preview images generated for image files in that folder so that they load up quickly the next time you browse that folder.”
Mr. Wadhwa also gives instructions on using a hex editor to recover the thumbs file to a viewable format. Very good info.
(If you do alot of file copy/pasting and you do a Ctrl+A to select all you will get an error message that there is a hidden file and if you want to select it…blah blah blah… that hidden file is thumbs.db)
To disable thumbnail creation Go to
Tools > Folder Options > View > Do not cache thumbnails