Thumbcache Forensics Cheat Sheet

What it is

To display folders in thumbnail view quickly, Windows Explorer caches a small preview of each picture, video, document or other previewable file in per-user databases. Since Windows Vista these are the thumbcache_*.db files, one per thumbnail size, plus an index. The cache is keyed by a hash-like identifier, not by the file path, and it is not purged when the source file is deleted. It is therefore one of the few places where the visual content of files that no longer exist can be recovered.

Location

Windows version	Path	Files
XP	`Thumbs.db` hidden in each folder viewed in thumbnail mode	One OLE compound file per folder
Vista / 7	`C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\`	`thumbcache_32.db`, `_96`, `_256`, `_1024`, `_sr`, `thumbcache_idx.db`
8 / 8.1	same folder	Adds `_16`, `_48`, `_wide`, `_exif`; 8.1 also `_1600` and `_wide_alternate`
10 / 11	same folder	`_16`, `_32`, `_48`, `_96`, `_256`, `_768`, `_1280`, `_1920`, `_2560`, `_sr`, `_wide`, `_exif`, `_wide_alternate`, `_custom_stream`, `thumbcache_idx.db`
Vista and later	`Thumbs.db` in remote folders	Still created when a folder is browsed through a UNC path in thumbnail view

The same Explorer folder also holds iconcache_*.db files (icon cache, same container format) and C:\Users\<user>\AppData\Local\IconCache.db exists as a separate legacy icon cache.

What it proves

A file existed on a location reachable by the user and was rendered as a thumbnail: local disk, USB drive, network share.
Visual content of pictures, video frames and some documents, even when the originals were deleted or stored on removed media.
User context: the cache lives in a user profile, so it is attributable to that account.
It does not prove that the user opened the file, or even looked at that exact thumbnail: Explorer, the file picker and some applications generate thumbnails for everything in a folder view.
On its own it does not give the file name or path; that requires mapping to the Windows Search index.

Key fields

Field	Meaning
Format version (file header)	20 Vista, 21 Win7, 30 Win8, 31 Win8.1, 32 Win10/11
Entry signature	`CMMM` marks each cache entry
Entry hash / cache ID	8-byte identifier of the thumbnail; one-way, cannot be reversed to a path
Identifier string	UTF-16 string of the cache ID used as entry name
Data size and data	Thumbnail image (typically JPEG, PNG or BMP)
Data and header checksums	CRC-64 values used by Windows to validate entries
`thumbcache_idx.db` entries	Map cache IDs to the entries in each size-specific database

Timestamps

Timestamp	Set when	Format	Pitfalls
Per-entry time	None: Windows 7 and later cache entries and index entries hold no timestamps	—	Do not infer when a thumbnail was created from its position alone
Database file modification ($SI)	Last write to that `thumbcache_*.db`	NTFS, UTC	Applies to the whole database, not to one thumbnail
Search index properties (after mapping)	File dates recorded when the file was indexed	FILETIME, UTC	Come from Windows Search, not from the cache

Retention and clearing

Entries are not removed when the source file is deleted; they remain until the cache is rebuilt, cleared or overwritten.
Disk Cleanup ("Thumbnails" category), privacy cleaners and manual deletion of thumbcache_*.db wipe the cache. Windows can also rebuild it on its own.
Old or invalidated entries can linger in unused space inside the database; carving the files and unallocated space for image headers can recover more.
Thumbnail generation can be disabled ("Always show icons, never thumbnails"); an empty cache is not by itself anti-forensics.

Collection

KAPE target: ThumbCache (all thumbcache_*.db of every profile). IconCacheDB collects only the legacy IconCache.db; no dedicated target covers iconcache_*.db or legacy Thumbs.db.
Velociraptor (Windows.Triage.Targets): ThumbCache.
Built-in: Explorer keeps the files open for the logged-on user; copy them from a shadow copy or with a raw copy method:

esentutl.exe /y "C:\Users\alice\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db" /vss /d E:\case\alice\thumbcache_256.db
dir /a /s C:\Thumbs.db

Collect the Windows Search index at the same time: without it, thumbnails cannot be tied back to file names.

Parsing tools

Thumbcache Viewer (free, open source): extracts thumbnails from thumbcache_*.db and iconcache_*.db for Vista to Windows 11, with HTML/CSV reports. It can load Windows.edb (ESE) or the Windows 11 SQLite index to map cache IDs to file paths; the command-line version processes whole folders.
Thumbs Viewer (same author, free): parses legacy Thumbs.db files.
libwtcdb (Joachim Metz, open source): library and format documentation for thumbcache databases.

Investigation tips

Map cache IDs through the System.ThumbnailCacheId property of the Windows Search index to recover the original path, name and dates of each thumbnail.
Thumbnails of pictures that exist nowhere else on the disk point to deleted files or to removable media; correlate with ShellBags, LNK files and USB device history.
Check the Recycle Bin and volume shadow copies for older versions of the thumbcache databases.
Look for Thumbs.db files on file servers: they show which remote folders were viewed in thumbnail mode and can contain images deleted from the share.
Report carefully: a thumbnail shows that a file was present and rendered, not that the user viewed or opened it.

Thumbcache

Tools