dec Windows Thumbnail Database Viewer

What is dec Windows Thumbnail Database Viewer?

Over time, Windows creates many auxiliary files that speed up system performance. These files may store information on computer usage and user activities, which can be confidential. Quite often this information can be used by forensic examiners as digital evidence in investigating crimes.

Thumbnail cache of Windows OS is an example of such files. Thumbnail cache consists of files that store miniature copies of images that have been viewed by the user. Cache is handled differently on different versions of Windows. In versions below Window Vista, the operating system created a hidden file called Thumbs.db in every directory with images and video files that has been viewed by the user. Starting with Windows Vista, the system comes with a centralized thumbnail database that contains five files, such as thumbcache_idx.db, thumbcache_1024.db, thumbcache_256.db, thumbcache_96.db, and thumbcache_32.db.

Media Center, which is distributed with Windows XP MCE, Windows Vista and Windows 7, has its own thumbnail cache. On Windows XP MCE, these are hidden files ehthumbs.db, as well as Thumbs.db, which are saved to every directory with images and video files that have been viewed by the user. Starting with Windows Vista, the name of the file ehthumbs.db has changed to ehthumbs_vista.db and extra files have been added, including Image.db, Video.db, TVThumb.db that store information in a centralized location.

Icon cache in IconCache.db stores desktop icons and Windows Start menu icons and can be used as a proof that a particular application was installed on the system.

dec Windows Thumbnail Database Viewer is an unique forensic application which makes it easy to find, view, analyze and create a report on the content of above mentioned files. The user is not required to have any knowledge of the internal structure of these files, their location in the particular version of the operating system. The program finds, detects, decodes and displays these files on its own. The only thing required from the user is to specify the disk or disks where to run a search.

dec Windows Thumbnail Database Viewer relies on low level reading of file formats, which totally excludes any modification of researched files. Moreover, the program, unlike similar tools, is able to decode broken files that were restored by external utilities after deletion. Broken files are restored partially in most cases.

Although the program was developed initially for law enforcement, dec Windows Thumbnail Database Viewer can also serve for quite a peaceful purpose – to restore lost images. This functionality is most effective when working with thumbnail cache on Windows Vista and Windows 7 because images are saved to thumbcache_1024.db with a size up to 1024x1024 pixels, which allows the user to restore an image in good quality.

Key features

• Support for thumbnail cache of Windows 7

  The program can decode cache created by Windows 7, which is a unique feature that has not been realized in any other application in the same category.

• Portable

  The user can run program from any device, including a removable one. The program is portable and does not require any frameworks or special libraries to do its job.

• Easy file search

  Find any file in a snap. The user does not need to search for files manually. The program can handle the search job automatically, saving the user time and efforts.

• Save search results

  The list of found files can be saved for future reference. Saved results let the user quickly open the files that have been found earlier without having to run a search again.

• Reports

  The program creates detailed reports on content of found files in HTML.

• Export

  The program lets the user save to a data storage device any information, such as found image thumbnails, as well as metadata associated with thumbnails.

• Tabbed interface

  The user can open additional tabs, which makes it easier and more convenient to analyze data.

• Markers

  With markers, the user can easily mark important information and get back to it later.

• Support for external applications

  The user can open found images in external applications associated with graphic files to edit images further – make them bigger, correct color and perform other operations.

• Clipboard

  The program allows the user to copy to clipboard any information, such as names of found files, found image thumbnails, metadata associated with thumbnails. Copied data can be pasted to other documents.

Screenshots

dec Windows Thumbnail Database Viewer main window

FAQ

Q) I bought the program and got the license key. What do I need to do with the key to activate the program?
A) Copy and paste the file of the key to the directory that contains the executable file. Once launched, the program detects the key and removes the limitation of the demo mode. Attention! If the key is deleted from the directory, the program downgrades to the demo mode automatically.

Q) I renamed the program from decWindowsViewer.exe to WindowsViewer.exe, and now it won’t detect the key.
A) Rename the key file from decWindowsViewer.xkey to WindowsViewer.xkey.

Q) I want to save the program to CD. How do I do it properly?
A) When you record the program to CD, it is important that the folder should contain the executable file, program key and an empty file with the name of the executable file and extension .config. The latter is necessary to disable the appearance of the License Agreement on program launch.

Q) The program won’t open or find thumbnail cache files, though it claims to decode them. I know for sure I have thumbnail cache files on my hard disk.
A) This may happen because you do not have access rights to these files due to specific security policies of your operating system. For example, it often occurs in Windows Vista and Windows Seven. Try running the program with administrator rights.

Q) It takes too long to open some files with the program. What’s the reason for it?
A) To decode files, the program uses algorithms that search for deleted data, letting users find data within files, even if there are no links to them in the index file. Though it takes long to process data, the algorithm allows extracting maximum information from a file.

List of decoded formats

	Windows (IconCache.db) © Microsoft	IconCache.db ShellIconCache
	Windows (thumbs.db) © Microsoft	Thumbs.db
	Windows 7 © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db
	Windows Live Photo Gallery © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db
	Windows Media Center © Microsoft	ehthumbs_vista.db ehthumbs.db Image.db Video.db TVThumb.db
	Windows Vista © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db

Download demo

Buy now