Thumbcache Images – An Overview
Thumbcache files are database files that are automatically generated by the Microsoft Windows operating system from Windows Vista onwards within the ‘hidden’ system directory located at the path \Users\[User Profile Name]\AppData\Local\Microsoft\Windows\Explorer\.
How are Thumbcache Images Stored?
Images within the Thumbcache files are automatically stored when a folder on the computer or a device connected to it is accessed by the user using the Thumbnail or Icons view within Windows Explorer.
The thumbnail or icons view include small images in a gallery format that contain the content of any images within the folder being viewed.
Why are Thumbcache Images of Significance in Computer Forensics?
Even when the original files are deleted from the folder, the automatically generated copy within the Thumbcache is not removed making them a good source of evidence for images that may have been deleted from normal aras of the hard drive.
Due to them being ‘hidden’ and inaccessible, a normal user is unlikely to be aware of the existence of images within Thumbcache files.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0845 882 7386 or via email on firstname.lastname@example.org, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.