Introduction
Thumbs.db is the hidden file in which Windows Explorer kept the thumbnails
of a folder’s pictures, in Windows Me, Windows 2000 and Windows XP. It sits beside the
pictures, and is not updated when they are moved or deleted, so it can still hold
thumbnails of pictures that have gone.
Microsoft has not published the format. It is a Microsoft Compound File, the
container of older Office documents, which is documented; the streams inside are known
only from reverse engineering, chiefly Vinetto,
and from what 327 real Thumbs.db files show. Windows Vista and later normally keep their
thumbnails in per-user thumbcache_*.db files. Those are a different format
and are not described here.
A Thumbs.db dropped on any page opens in the explorer, which shows the
thumbnails, each with its file name and modified date from the catalogue. The oldest
kind of thumbnail, whose JPEG tables are left out, is listed but not drawn.
Structure
The file is a Compound File holding
one stream for each thumbnail. In the usual form there is also a stream called
Catalog, which lists the pictures: the
Catalog page describes it. Each
thumbnail stream has a small header,
then a JPEG or PNG image. A second form has no Catalog, and each stream is named by a
size and a hexadecimal hash.
0Compound File header version, sector sizes, where the FAT and the directory are512512Sectors the FAT, the directory and the streams, in any ordervaries…Catalog stream a header, then one entry per picturevaries…Thumbnail streams named by the entry’s number reversed, each a short header and an imagevaries
Also used for
- SQLite 2 database – SQLite 2.6 to 2.8’s file: 1,024-byte pages in the machine’s byte order, every value text.
- SQLite 3 database – A whole SQL database in one file: pages of b-trees, typed values, UTF-8 or UTF-16 text.
Links
Software
- Windows Explorer – writes and reads these files in picture folders (Windows)
- Vinetto – forensic tool that lists and extracts Thumbs.db thumbnails (Python)
Reference
- MS-CFB – Microsoft’s specification of the Compound File container
- Thumbs.db on the Forensics Wiki – notes on the format