In the usual form of Thumbs.db, a stream named Catalog lists the pictures,
with the number, the modified time and the name of each. It is not documented by
Microsoft. The layout below was checked against 268 real files: every Catalog read to its
end, and every entry matched a thumbnail stream.
Header
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 2 | Header size | 16 in most files. 8 in version 4 files, which stop after the count. |
| 2 | 2 | Version | Seen as 4, 5, 6 and 7. |
| 4 | 4 | Count | The number of entries. |
| 8 | 4 | Thumbnail width | In pixels, for example 96. |
| 12 | 4 | Thumbnail height | In pixels, for example 96. |
Entries
One after another, as many as the header counts.
0Entry size in bytes44Identifier the picture’s number48Modified the picture’s last-write time816File name UTF-16, zero-terminatedvaries…two more zero bytes2
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 4 | Entry size | The size of this entry. |
| 4 | 4 | Identifier | A number. The thumbnail is in the stream named by its digits reversed: identifier 123 is the stream 321. |
| 8 | 8 | Modified | The picture’s last-write time as a FILETIME. |
| 16 | varies | File name | The picture’s name. Older files can hold a full path. |