Since the introduction of Windows 95B, Microsoft users have been able to select a thumbnail view of any system folder. This option prompts the operating system to create a miniature preview of each file. By default, these generated images are archived to a local thumbnail database for quick system retrieval. Once an image is placed in the database, it will never be removed. By viewing the contents of thumbnail databases, a forensic investigator can easily examine the past and present media of a given system. Though this cache is not a perfect record, it is a good indicator of media storage locations and habits. For these reasons, we present ThumbScan, an automated search tool for locating and analyzing the archived thumbnails of modern Windows systems.
Library of Congress Subject Headings
Database searching--Computer programs; Search engines--Design; Cache memory; Microsoft Windows (Computer file); File organization (Computer science)
Elinski, Joseph, "ThumbScan: A lightweight thumbnail search tool" (2010). Thesis. Rochester Institute of Technology. Accessed from
RIT – Main Campus