How Does ThumbnailExpert Work
It is no secret that some apps hold small versions of pictures and previews of video files in a thumbnail cache to speed up the display of thumbnails in folders. In many cases, an app can also store additional information about a file, including last modification date, file size, height, width, and so on, or even original fragments with metadata (exif, iptc, xmp, and more) from jpeg files. ThumbnailExpert enables a user to extract this data and examine cache files.
A classic example of an app creating thumbnail cache is Windows Explorer, storing thumbnails of graphics files, and certain document and movie files in the thumbnail cache files Thumbs.db, which were replaced by thumbcache_idx.db, thumbcache_1024.db, thumbcache_256.db, thumbcache_96.db and thumbcache_32.db files in Windows Vista and Windows 7.
Most programs store in the thumbnail database all the thumbnails that have ever been generated, even if the original image has been deleted. Some apps even create thumbnails for the files encrypted with EFS and TrueCrypt, thus enabling you to retrieve data even if the encrypted files are inaccessible. Thumbnail cache examination therefore is an important part of a truly thorough forensic investigation, and ThumbnailExpert provides all the necessary tools for this process.
What Benefits Does ThumbnailExpert Provide?
-
Perform Computer Forensic Examination
Due to its data extraction capabilities, ThumbnailExpert appears to be a perfect tool for forensic experts, as it allows examining thumbnail database and thumbnail cache files for a thorough computer forensic investigation. The application has been developed with the assistance of members of the Russian project "Computer forensics and research". The development team has followed the advice and recommendations provided by members of the project to create the full-featured yet easy-to-use thumbnail forensic software.
-
Recover Data
While being essential for forensic purposes, ThumbnailExpert can also serve as data recovery software. If a sudden hardware failure, virus attacks or human error cause data corruption, you can still recover thumbnail images from the database, because deleting images does not remove or erase thumbnails from the cache. As a rule, you will be able to recover miniature images, but in Windows Vista the thumbnails can be as large as 1024x1024, ensuring a reasonable quality recovery.
-
Prevent Data Leaks
What’s more, the smart app helps its users detect cache files, the feature that can be extremely useful for those concerned about privacy. As you remember, the data stored in graphics files can be automatically duplicated in thumbnail cache. If such data includes confidential business information, caching can eventually lead to data leaks. With ThumbnailExpert you can detect cache files on a hard drive and delete them if necessary.
Why Is ThumbnailExpert Efficient?
ThumbnailExpert employs both format signatures search and cache structure information. This comprehensive approach ensures that the program will manage to extract even the thumbnails stored in proprietary formats.
One of the strengths of the app is constant improvement. The development team tracks the new versions of programs supported by ThumbnailExpert, detecting changes in file caсhе formats. When a format is changed, the app gets updated to provide support for it. For instance, ThumbnailExpert was the one of the first program to support cache decoding for Windows 7.
Please do not hesitate to contact us if you would like support for a new format to be added. Our experts will carry out an analysis and, if possible, add support for the format in question.
| Read more | Download demo | Buy now |
