Each thumbnail is a separate stream. The headers below were read from 2,150 real thumbnail streams and hold in all of them. Nothing here is documented by Microsoft.
Stream names
With a Catalog, a thumbnail stream is
named by the digits of its entry’s identifier reversed: identifier 165 is the stream
561. Without one, each stream is named by a size and a hexadecimal hash,
such as 96_ followed by the hash; the file holds no picture names.
The header
The header comes first in every thumbnail stream. There are two forms.
| Offset | Size | 12-byte form | 24-byte form |
|---|---|---|---|
| 0 | 4 | 0x0C, the header size | 0x18, the header size |
| 4 | 4 | Type: 1 | Type: 3 |
| 8 | 4 | The size of the data after this header | The size of the data after this header |
| 12 | 12 | The picture starts here | Three more 32-bit words, not established here. The picture starts at 24. |
The 24-byte form belongs to the second, hashed-name form of the file; in the files checked, it holds a JPEG or a PNG. The 12-byte form holds a JPEG.
The picture
0Thumbnail header 12 bytes, or 2412 or 24…the picture: a JPEG or a PNG file, wholevaries
In the files checked, 1,360 streams held a complete JPEG, all starting with the usual
FF D8 FF E0, and 162 held a PNG, all in the 24-byte form.
Older thumbnails
Some thumbnails in Catalog files do not hold a complete JPEG. After the 12-byte header comes a second header:
| Offset | Size | Name | Description |
|---|---|---|---|
| 12 | 4 | Marker | 1. |
| 16 | 4 | Data size | The number of bytes after this header. |
| 20 | 4 | Width | In pixels. |
| 24 | 4 | Height | In pixels. |
After that is a JPEG start of image, a frame header and a scan, with no quantisation or
Huffman tables, and no JFIF header. The frame names its four components
R, G, B and A. Vinetto rebuilds a
whole JPEG from these by adding the standard tables, and treats the four channels in
its own way; that reading could not be confirmed here. So this site’s viewer lists these
thumbnails, with their file names and dates, but does not draw them.
In the 327 files checked, 628 of the 2,150 thumbnail streams were of this kind.