This script parses Windows Vista, Windows 7, Windows 8 and Windows 10 thumbcache_*.db files.

The script will process the files specified by the user and will bookmark any thumbcache records in those files provided they contain thumbnail data.

Note that thumbcache records that don't contain data won't be processed.

In addition to bookmarking the thumbnail data the script will optionally write that data into a logical evidence file that can then be brought back into the case.

Note that thumbcache files do not store the path of source images in the same way as thumbs.db files. Each thumbnail is identified by a thumbcache ID.

This ID most often takes the form of an 8-byte hash but Windows Vista may also generate IDs containing file-paths of one form or another.

As one would expect, the hash is one way so the path of the source image cannot be derived from the hash.

One way to map the hash to the source file is to query the Windows.edb search database. This stores the ID as the System.ThumbnailCacheId property of the source file. Note that this is unlikely to be successful for deleted files because the Windows.edb database is maintained in an up-to-date state.

The bookmark comment for each thumbcache record will include the thumbcache ID, offset, size and type (BMP, JPG or PNG) of the thumbnail data.

The logical evidence file produced by the script will store each thumbnail using the path to the source thumbcache file; the thumbnail itself will be given a name comprising the thumbcache ID and a file-extension matching the thumbnail type.

Note: Thumbcache IDs containing a path (usually only certain Vista thumbcache records have these) will have each backslash replaced with a center dot character (·) so as to prevent path-naming problems in the LEF.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training