Thumbs.db

Description: Hidden file in directory where images on machine exist stored in a smaller thumbnail graphics. thumbs.db catalogs pictures in a folder and stores a copy of the thumbnail even if the pictures were deleted.

Location:

• Automatically created anywhere and accessed via a UNC Path (Local or Remote)

Notes:

• Thumbnail Picture of Original Picture
• Document Thumbnail (Even if Deleted)

Analysis: We can analyze these files with ThumbsViewer, a GUI application created by Eric Kutcher for analyzing thumbs.db files. You can load one or more thumbs.db files at once into Thumbs Viewer for analysis. An image of the selected file will be displayed in a second window.