Microsoft Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for ...

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ef ...

s, starting with the

Internet Explorer 4 Microsoft Internet Explorer 4 (IE4) is a graphical web browser that Microsoft unveiled in Spring of 1997, and released in September 1997, primarily for Microsoft Windows, but also with versions available for the classic Mac OS, Solaris, and H ...

Active Desktop Update for Windows 95 to 98,Thumbs.db files forensic issues: AccessData Corporation
/ref> a thumbnail cache is used to store

thumbnail Thumbnails are reduced-size versions of pictures or videos, used to help in recognizing and organizing them, serving the same role for images as a normal text index does for words. In the age of digital images, visual search engines and imag ...

images for

Windows Explorer File Explorer, previously known as Windows Explorer, is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface for accessing the file ...

's thumbnail view. This speeds up the display of images as these smaller images do not need to be recalculated every time the user views the folder.

Purpose

Windows stores thumbnails of graphics files, and certain document and movie files, in the Thumbnail Cache file, including the following formats:

JPEG JPEG ( ) is a commonly used method of lossy compression for digital images, particularly for those images produced by digital photography. The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and imag ...

, BMP, GIF, PNG,

TIFF Tag Image File Format, abbreviated TIFF or TIF, is an image file format for storing raster graphics images, popular among graphic artists, the publishing industry, and photographers. TIFF is widely supported by scanning, faxing, word process ...

AVI Avi is a given name, usually masculine, often a diminutive of Avram, Avraham, etc. It is sometimes feminine and a diminutive of the Hebrew spelling of Abigail. People with the given name include: * Avi (born 1937), Newbery award-winning Americ ...

PDF Portable Document Format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating systems. ...

PPTX Office Open XML (also informally known as OOXML) is a zipped, XML-based file format developed by Microsoft for representing spreadsheets, charts, presentations and word processing documents. Ecma International standardized the initial version a ...

, DOCX,

HTML The HyperText Markup Language or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaS ...

, and many others. Its purpose is to prevent intensive disk I/O, CPU processing, and load times when a folder that contains a large number of files is set to display each file as a thumbnail. This effect is more clearly seen when accessing a DVD containing thousands of photos without the thumbs.db file and setting the view to show thumbnails next to the filenames. Thumbnail caching was introduced in Windows 2000; wherein the thumbnails were stored in the image file's alternate data stream if the operating system was installed on a drive with the

NTFS New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft. Starting with Windows NT 3.1, it is the default file system of the Windows NT family. It superseded File Allocation Table (FAT) as the preferred fil ...

file system. A separate Thumbs.db file was created if Windows 2000 was installed on a FAT32 volume.

Windows Me Windows Millennium Edition, or Windows Me (marketed with the pronunciation of the pronoun "me"), is an operating system developed by Microsoft as part of its Windows 9x family of Microsoft Windows operating systems. It is the successor to Windo ...

also created Thumbs.db files. From Windows XP, thumbnail caching, and thus creation of Thumbs.db, can optionally be turned off. In Windows XP only, from Windows Explorer Tools Menu, ''Folder Options'', by checking "Do not cache thumbnails" on the ''View'' tab. Under Windows 2000, Windows Me, and Windows XP, a context menu command to force refreshing the thumbnail is available by right clicking the image in ''Thumbnail'' view of Windows Explorer.

Thumbs.db

Thumbs.db files are stored in each directory that contains thumbnails on Windows systems. The file is created locally among the images, however, preventing system wide use of the data and creating additional data load on removable devices.

Windows XP Media Center Edition Windows XP Media Center Edition (MCE) is a version of the Windows XP operating system which was the first version of Windows to include Windows Media Center, designed to serve as a home-entertainment hub. The last version, Windows XP Media Cen ...

also creates ehthumbs.db which holds previews of video files. Each thumbnail created in a directory is represented in this database file as a small JPEG file, regardless of the file's original format. The images are resized to 96×96 pixels by default or a proportional miniature of their original shape for non-square images, with 96 pixels on the longer side. The size can be controlled by a setting on Windows Registry. Each folder with initiated thumbnail views (that is where they have displayed a Thumbnails or Filmstrip view in Windows Explorer) will have a Thumbs.db file. Folders with pictures also display previews on their icon when displayed in Thumbnail mode – the first four images in the folder at 40×40 pixels (or proportionally shaped), with a 1-pixel divider overlaid on a standard large folder icon. The Thumbs.db file is stored in

Compound File Binary Format Compound File Binary Format (CFBF), also called Compound File, Compound Document format, or Composite Document File V2 (CDF), is a compound document file format for storing numerous files and streams within a single file on a disk. CFBF is develope ...

format, the same format that many

Microsoft Office Microsoft Office, or simply Office, is the former name of a family of client software, server software, and services developed by Microsoft. It was first announced by Bill Gates on August 1, 1988, at COMDEX in Las Vegas. Initially a marketin ...

products use.

Centralized thumbnail cache

Beginning with

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...

, thumbnail previews are stored in a centralized location on the system. This provides the system with access to images independent of their location, and addresses issues with the locality of Thumbs.db files. The cache is stored at %userprofile%\AppData\Local\Microsoft\Windows\Explorer as a number of files with the label thumbcache_''xxx''.db (numbered by size); as well as an index used to find thumbnails in each sized database. However, when browsing network shares with write permission, Windows Vista and Windows 7 store a Thumbs.db file in the remote directory instead of using the (local) central thumbnail cache. This can cause issues when deleting remote shares, as the directory will become locked for a period of time when selected as Windows Explorer automatically creates a remote Thumbs.db file. Creating Thumbs.db files on remote shares can be disabled with a

Group Policy Group Policy is a feature of the Microsoft Windows NT family of operating systems (including Windows 7, Windows 8.1, Windows 10, Windows 11, and Windows Server 2003+) that controls the working environment of user accounts and computer accounts. G ...

setting.

As forensic evidence

Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive. For example, the FBI used the "thumbs.db" file in 2008 as evidence of viewing depictions of

child pornography Child pornography (also called CP, child sexual abuse material, CSAM, child porn, or kiddie porn) is pornography that unlawfully exploits children for sexual stimulation. It may be produced with the direct involvement or sexual assault of a ...

. In 2013, research was conducted that focused on the Digital Forensic implications of thumbnail caches and recovering partial thumbnail cache files. It identified that whilst there is a standard definition of a thumbnail cache the structure and forensic artifacts recoverable from them varies significantly between operating systems. The work also showed that the thumbcache_256.db contains non-standard thumbnail cache records which can store interesting data such as network place names and allocated drive letters.
Morris & Chivers

References

External links

Thumbcache Viewer
– open-source thumbcache_*.db viewer
Thumbs Viewer
– Source to view Thumnail
Vinetto
is a forensics tool to examine Thumbs.db files. *{{webarchive , url=https://web.archive.org/web/20131116234204/http://www.thumbnailexpert.com/en/formats/windows-thumbnail-cache/ , date=November 16, 2013 , title=Windows thumbnail cache – Description of thumbs.db file

Windows files