ThumbScan: A lightweight thumbnail search tool
Joseph Elinski · RIT Scholar Works (Rochester Institute of Technology) · 2010
Since the introduction of Windows 95B, Microsoft users have been able to select a thumbnail view of any system folder. This option prompts the operating system to create a miniature preview of each file. By default, these generated images are archived to a local thumbnail database for quick system retrieval. Once an image is placed in the database, it will never be removed. By viewing the contents of thumbnail databases, a forensic investigator can easily examine the past and present media of a given system. Though this cache is not a perfect record, it is a good indicator of media storage locations and habits. For these reasons, we present ThumbScan, an automated search tool for locating and analyzing the archived thumbnails of modern Windows systems.