BergssonForensics.
Menu
← Back to catalogue
User activity

Thumbnail caches

Windows thumbnail databases can retain rendered previews of items shown by the shell or applications. A cached image can be useful visual context, but mapping it back to a path or a user action requires additional evidence.

Listen to the full guide

Download MP32 min · AI narration

Useful for

Support that a preview image was retained in the examined cache.

Important limit

Prove the user deliberately opened the original file or owned its content.

Location & availability

User AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db

Cache formats, identifiers and retention vary. Preview generation can be automated.

Fields to examine

  • Recovered thumbnail image and cache identifier.
  • Database/profile and extraction context.
  • A separately established path association, if one can be recovered.

What it can establish

  • Support that a preview image was retained in the examined cache.

What it cannot prove

  • Prove the user deliberately opened the original file or owned its content.
  • Invent an original filename from a thumbnail that has no validated mapping.

Use it in a screenshare

  1. Preserve cache databases from the relevant profile without browsing unrelated image folders.
  2. Extract previews with a format-aware tool and retain their cache identifiers.
  3. Correlate any candidate path with filesystem or shell records; distinguish a visual resemblance from a verified content identity.

Worked example

A cache preview resembles an application screenshot. It is a lead to a rendered image, not proof the pictured application ran on that machine. The image could itself have been downloaded.

Cross-check the finding

  • ShellBags →Support that a directory was represented in retained shell/profile state.
  • RecentDocs →Support a retained recent-document association in a profile.
  • $MFT →Support the presence and recorded metadata of a particular file record.

Sources

Choose another artefact →