IT Forensics – Windows
Forensic analysis of the Windows thumbnail cache – thumbnails as digital evidence
The Windows thumbnail cache stores thumbnails of files that have been displayed in Windows Explorer. Even if the original files have been deleted or the storage media removed, these thumbnails may still be present under certain circumstances. As a result, the thumbnail cache is an important artefact in Windows forensics.
As part of a professional IT forensic investigation, the thumbnail cache is never analysed in isolation. Only by correlating it with other artefacts – such as the Master File Table (MFT), the USN Journal, LNK files, jump lists, the Windows Registry and the event logs – is it possible to make a reliable technical assessment.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse the Windows thumbnail cache, extract any existing thumbnails and assess their significance in the context of other digital traces. All stages of the investigation are documented in a transparent manner.
Typical areas of application
This is how the thumbnail cache is analysed
Once a forensic image has been created, the thumbnail cache files are analysed. The information obtained is correlated with other Windows artefacts and then subjected to a technical assessment.
Why is the thumbnail cache important?
The thumbnail cache can provide clues as to which files were viewed on a system, even if they are no longer present. However, meaningful conclusions can only be drawn from a comprehensive analysis of all relevant digital traces.
Frequently Asked Questions
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of the Windows thumbnail cache or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.
Related to this topic
- In-depth forensic analysis of the Windows pagefile.sys – Reconstructing paged-out memory contents
- In-depth forensic analysis of Windows’ hiberfil.sys – Reconstructing saved RAM contents
- Forensic analysis of Windows ReadyBoot and ReadyBoost artefacts – tracing boot processes and system usage
- Forensic analysis of Windows RAM dumps – Securing ephemeral evidence from main memory