What is the DCIM Folder
DCIM is an abbreviation of Digital Camera IMages and is the name of a folder that is automatically created on the memory cards within most digital cameras as well as on most (if not all) mobile phones where the user is able to capture and store photographs.
The DCIM folder contains digital photos taken by or stored to the device, however, the folder can also contain various other files associated with the access and viewing of the images within the DCIM folder, including images that were previously stored within it.
The .thumbnails sub-folder is automatically generated within the DCIM folder on an Android based mobile phone by default.
.Thumbnails Folder Within the DCIM Folder of Android Devices
The .Thumbnails folder is hidden from the normal user by default and, generally, the ‘.’ at the start of the folder name within Android indicates that it is hidden.
It is possible to view the folder using a file manager, the phone may contain one by default or one can be downloaded from the Play Store.
How to View the Content of the DCIM .Thumbnails Folder
It may be that the ‘Show Hidden Files’ option within the manager needs to be selected, however, by navigating to the DCIM folder on the device, the file manager will display the content of that folder which will include the folder named .Thumbnails.
By accessing the .Thumbnails folder, the images within it can be seen. Those images will be all of those displayed within the Photos gallery of the device.
Each of the images consist of a smaller version of all images, including those that have been subsequently deleted, browsed within the Photos gallery.
The images also display a file name and time/date stamp that relates to the point of storage date modified) of the original image, meaning that the date of creation of an image can be identified from the thumbnail copy even if the original normal sized version is no longer present.
This allows those images to be quickly loaded within the Photos gallery when the user accesses it again.
As the .Thumbnails folder retains smaller versions of all images browsed within the ‘Photos’ directory, it can often contain evidence that the user has deleted and it can also take up a large amount of space on a phone.
Differing versions of Android also contain a thumbdata file that can also contain a significant amount of image data and reside within the .Thumbnails folder.
Removing the Data Within the .Thumbnails Folder
It is possible to select the .Thumbnails folder and delete it from the device, which will remove it and any images within it and may save a significant amount of space from the device.
However, in doing this there may be issues, including that any current images may no longer display as thumbnails in the Photos gallery.
Alternatively, any images within the Photos gallery will displayed as thumbnails again when it is accessed, thereby causing them to be regenerated within the .thumbnails gallery.
Therefore, an alternative could be to install a good cache cleaning application that will automatically identify which of the images within the Thumbnails directory and remove them from the device, rather than simply removing all of them which may cause operational issues.
How to Prevent the Thumbnails Folder From Returning
Whilst the content of the .Thumbnails allows the content of the Photos folder to be displayed quickly and efficiently, it may be that the user does not want the facility to return and the space associated with it to be used for other data.
If a file named .thumbnails is created by the user, the device should not automatically recreate a new .Thumbnails directory or any of the images within it.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or
via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any
computer forensic investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited
to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
https://athenaforensics.co.uk/service/mobile-phone-forensic-experts/
https://athenaforensics.co.uk/service/computer-forensic-experts/
