ThumbnailExpert

What is ThumbnailExpert?

ThumbnailExpert is a unique program for forensic examination of thumbnail cache files created by different multimedia applications. They may include image viewers, video editors, file managers, software for mobile phones and many other applications. All these programs are similar in one – they all create files that store intermediate results of their work which may be interesting for forensic experts as digital evidence.

ThumbnailExpert makes it easy to find, view, analyze and create reports on the content of thumbnail databases generated by many applications. The user is not required to have any knowledge of the internal structure of these files and their location because the program is able to find, decode and display these files on its own. You only need to select a disk or disks to run a search, and the rest of the job is done hands down.

ThumbnailExpert has been developed in close collaboration with end-users and optimized primarily to the needs of forensic experts whose ideas and feedback are reflected in the feature set and simple, intuitive interface designed in the Windows Explorer-style. Thanks to this the user can perform tasks with remarkable ease.

The unique feature of the program is a great number of decoded formats. Currently there are over 70 supported formats, and their number is constantly growing thanks to the continuous efforts of the development team. The authors keep track of new software releases, new versions of existing applications and study the mechanisms they employ to cache information. If a new format appears or an old one is modified, ThumbnailExpert is updated instantly to address this change. Thus, for example, ThumbnailExpert was one of the first programs to introduce support for processing a new thumbnail cache format of Microsoft Windows 7.

As an additional feature, ThumbnailExpert lets users view images contained in intermediate files. The program supports the most common graphic formats, such as BMP, GIF, PNG and JPEG. If a picture contains metadata, such as segments of JPEG files (EXIF, IPTC, etc.), this data is also displayed. Unique to this ability is that the program relies on signature analysis of file content, rather than file extension to determine the presence of an image in a file. This makes it possible to find all images in a file, rather than just the first one which is typical of many similar utilities.

ThumbnailExpert can be used not only in criminal investigation, but may also serve as a tool to recover lost data. In most cases, thumbnail cache contains miniature copies of existing graphic files, but sometimes thumbnail images may have the same size as their originals. For example, Nokia PC Suite software saves original graphic files from the cell phone memory to its thumbnail database, PCCSFile.db. Standard Windows Vista and Windows 7 databases contain thumbnail images with a size up to 1024x1024 pixels. So, in case original files are lost, ThumbnailExpert can be used to restore pictures from thumbnail cache in fairly high quality.

ThumbnailExpert uses low-level reading of file formats which allows an expert to examine files without any modifications. Moreover, the program, unlike similar applications, is able to decode partially even broken files that were restored after deletion using other tools. In case a thumbnail database consists of multiple files, the program can decode even separate files if the rest of the files are unrecoverable.

Key features

• Decode thumbnail databases of over 70 applications

  The program offers full support for thumbnail databases of many programs, and the number of supported formats keeps on growing constantly. It is possible to decode separate files from a thumbnail database.

• View standard graphic files

  The program allows the user to view standard graphic files in BMP, GIF, PNG and JPEG. It is also possible to run a search for images in these formats within any file.

• View metadata of graphic files

  The program can show the content of EXIF segments of JPEG files, including thumbnails they contain.

• Portable

  The user can run program from any device, including a removable one. The program is portable and does not require any frameworks or special libraries to do its job.

• Easy file search

  Find any file in a snap. The user does not need to search for files manually. The program can handle the search job automatically, saving the user time and efforts.

• Save search results

  The list of found files can be saved for future reference. Saved results let the user quickly open the files that have been found earlier without having to run a search again.

• Reports

  The program creates detailed reports on content of found files in HTML.

• Export

  The program lets the user save to a data storage device any information, such as found image thumbnails, as well as metadata associated with thumbnails.

• Tabbed interface

  The user can open additional tabs, which makes it easier and more convenient to analyze data.

• Markers

  With markers, the user can easily mark important information and get back to it later.

• Support for external applications

  The user can open found images in external applications associated with graphic files to edit images further – make them bigger, correct color and perform other operations.

• Clipboard

  The program allows the user to copy to clipboard any information, such as names of found files, found image thumbnails, metadata associated with thumbnails. Copied data can be pasted to other documents.

Screenshots

ThumbnailExpert main window

FAQ

Q) I bought the program and got the license key. What do I need to do with the key to activate the program?
A) Copy and paste the file of the key to the directory that contains the executable file. Once launched, the program detects the key and removes the limitation of the demo mode. Attention! If the key is deleted from the directory, the program downgrades to the demo mode automatically.

Q) I renamed the program from ThumbExpert.exe to Expert.exe, and now it won’t detect the key.
A) Rename the key file from ThumbExpert.xkey to Expert.xkey.

Q) I want to save the program to CD. How do I do it properly?
A) When you record the program to CD, it is important that the folder should contain the executable file, program key and an empty file with the name of the executable file and extension .config. The latter is necessary to disable the appearance of the License Agreement on program launch.

Q) The program won’t open or find thumbnail cache files, though it claims to decode them. I know for sure I have thumbnail cache files on my hard disk.
A) This may happen because you do not have access rights to these files due to specific security policies of your operating system. For example, it often occurs in Windows Vista and Windows Seven. Try running the program with administrator rights.

Q) It takes too long to open some files with the program. What’s the reason for it?
A) To decode files, the program uses algorithms that search for deleted data, letting users find data within files, even if there are no links to them in the index file. Though it takes long to process data, the algorithm allows extracting maximum information from a file.

List of decoded formats

	3D Photo Browser © Mootools software	contents.obv
	ABC-View Manager © ABC-View	*.abt *.abc
	ACDSee © ACD Systems, Ltd.	Asset.dbf Thumb1.dbf Thumb2.dbf Thumb.dbf Thumb1.fpt Thumb2.fpt Thumb.fpt
	ACDSee Classic © ACD Systems, Ltd.	ImageDB.ddf ImageDB.dtf ImageDB.aid
	Acoustica CD Label Maker © Acoustica Inc.	*dir.idx *.idx *.dat
	Adobe Photoshop Album © Adobe Systems Incorporated	tn.4.cache
	Adobe Photoshop Lightroom © Adobe Systems Incorporated	*.lrcat *.noindex thumbnail-cache.db
	AhaView © Aha-soft	thumb.dat
	ALSee © ESTsoft Corp.	ALSeeCacheAppendix.adx ALSeeCache_*.idx CacheList.kyn *.lst *.dat
	Alteros 3D (Alteros Viewer) © Lighttek Software	thumb.idx thumb.dbx
	Arles Image Explorer © Digital Dutch	cache.sqlite
	Axialis CursorWorkshop © Axialis Software	*.v03
	Axialis IconWorkshop © Axialis Software	*.v03
	Axialis MediaBrowser © Axialis Software	*.v03
	Bibble © Bibble Labs Inc	base thumbs
	BraveViewer © BraveTech Inc.	brwseimg.brv
	BR`s PhotoArchiver © BR Software, Asker, Norway	PhotoIndex.pxf
	Clip Organizer © Microsoft	mstore10.mgc
	CodedColor PhotoStudio © 1STEIN GmbH	files.bin *.dat
	CorelPainter © Corel Corporation, Inc.	PREVIEW.PIX
	Directory Opus © GPSoftware	*.db
	EF Commander © Emil Fickel	ThumbsDB
	ExifPro © Magda and Michal Kowalski	CacheDb.bin
	FastStone Image Viewer © FastStone Soft	FSViewer.db
	FileCenter © Lucion Technologies, LLC	*.album
	FreshView © FreshDevices	FViewer.dat *.fv
	Graphic Workshop Professional © Alchemy Mindworks	GWSPRO.TDB *.THN
	HP Photosmart Essential © Hewlett-Packard Co.	asset.yos thumbnail.db thumbnailSel.db
	IDimager © IDimager Systems, Inc	idimager.cat.db idimager.thumbs.db
	Image Data Converter SR © Sony Corporation	.Sony_ImageDataConverterSR_BrowserDiskCache
	Image Eye © FMJ-Software	ImageEye.iei
	Imagic © Stepok Image Lab	FLD*.tmp
	Kodak EasyShare © Kodak	EasyShare.me EasyShare.mm ESBK.mb ESBK.mbb
	MAGIX Photo Manager © MAGIX	Cache.mxc3 mxfilerelatedcache.mxc2
	MediaImpression © ArcSoft Inc.	rocket2.db RocketThumbDB.db
	Microsoft Office Picture Manager © Microsoft	*.jpg
	Microsoft Picture It! © Microsoft	piorg.db piorg7.db
	Nero Vision © NERO AG	*.FAC
	Nokia Lifeblog © Nokia	NokiaLifeblogDataBase.db3 NokiaLifeblogThumbnails.db3
	Nokia PC Suite © Nokia	PCCSFile.db
	Nokia Photos © Nokia	MDataStore.db3
	OLYMPUS Studio © OLYMPUS IMAGING CORP	File.xml *.dat
	One Cat File Manager © Keith Leinenbach	cachedirs.txt
	One Cat Viewer © Keith Leinenbach	cachedirs.txt
	Paint Shop Pro © Corel Corporation, Inc.	pspbrwse.jbf
	PaperPort © Nuance Communications, Inc.	PP11Thumbs.ptn2 PPThumbs.ptn2 PP11Thumbs.ptn PPThumbs.ptn
	Photo Commander © Ashampoo	ash.db bgs.db *.dbc *.dbt
	Photo Go © Sony Creative Software Inc.	PhotoGo.db
	Photo Manager 2008 © Proxima Software	PhotoManager.db
	PhotoCool © Sunwise	photocool.brw
	PhotoImpression © ArcSoft Inc.	pi6bup.mdb 1TF.stf
	PhotoLine © Computerinsel GmbH	Browse.plb
	PhotoPhilia © Pholix Software	$MOSAICS.MAP *.phm
	PhotoScape © MOOII TECH	photothumb.db
	Picasa 2 © Google, Inc.	thumbindex.tid index-bigthumbs.db bigthumbs.db index-previews.db previews.db index-thumbs.db Thumbs.db index-thumbs2.db thumbs2.db
	Picasa 3 © Google, Inc.	thumbindex.db bigthumbs_index.db bigthumbs_0.db previews_index.db previews_0.db thumbs_index.db thumbs_0.db thumbs2_index.db thumbs2_0.db
	Picture Information Extractor © Picmeta Systems	thumbs.album *.album
	Picture Motion Browser © Sony Corporation	.Sony_PMBrowser1000_BrowserDiskCache .Sony_PMBrowser1000_BrowserDiskCache.idx
	PicViewer 2 © Anix Software	PicView.cch
	PixFiler © BR Software, Asker, Norway	PhotoIndex.pxf PhotoIndex.thumbsdb
	Regards © Figuinha Jacques	database.db *.db
	Resco Photo Viewer © Resco, sro	RAlbum.ra_
	Samsung mobile phone © Samsung	SThumbDB.tdb
	Samsung New PC Studio © Samsung	photomanager.dat photothumbs3.db photothumbs2.db photothumbs1.db videomanager.dat videothumbs3.db videothumbs2.db videothumbs1.db musicmanager.dat
	Samsung PC Studio © Samsung	mmdb_s1.mdb
	Shareaza © Shareaza Development Team	Shareaza.db3 SThumbs.dat
	Snapact Photo Manager © Tecagora Solutions Inc	db.db3
	SortPix XL © IN MEDIA KG	*.album
	ST Thumbnails Explorer © Softfields Technologies	STE.dbs
	Total Commander © Christian Ghisler	tcthumbs.db tcthumbs.idb
	Turbo Photo Album © Stepok Image Lab	TPhoto.prp
	Ulead Photo Explorer © Ulead Systems, Inc	pecache.idx pe*.inf pe*.cah
	UltraExplorer © Mustangpeak Software	Thumbnails.album *.album
	Unknown application (PCM.db)	PCM.db
	Vallen JPegger © Vallen-Systeme	jpeggeri.dat
	Viewer2 © Viewer2 Development Team	viewer2.db
	ViewNX © Nicon Corporation	NkCacheFolder.nki NkCacheLarge.nki NkCacheNormal.nki NkCacheSmall.nki NkCacheLarge.nkd NkCacheNormal.nkd NkCacheSmall.nkd
	WildBit Viewer © WildBit Software	ThumbnailsCache.dat *.album
	Windows (IconCache.db) © Microsoft	IconCache.db ShellIconCache
	Windows (thumbs.db) © Microsoft	Thumbs.db
	Windows 7 © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db
	Windows Live Photo Gallery © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db
	Windows Media Center © Microsoft	ehthumbs_vista.db ehthumbs.db Image.db Video.db TVThumb.db
	Windows Vista © Microsoft	thumbcache_idx.db thumbcache_1024.db thumbcache_256.db thumbcache_96.db thumbcache_32.db
	WinNc © Dunes MulitMedia, Inc.	WinNcThumbs.db
	WS_FTP © Ipswitch, Inc	IpsThumb.db
	Xentient Thumbnails © Ignacio Alvarez Morales	data
	XnView © Pierre-e Gougelet	XnView.db
	XYplorer © Donald Lessau	*.dat2
	Zoner Photo Studio © Zoner Sofware	data.zoner-index-cache data.zoner-rawdata-cache ZPSCache.dat
	ZoomBrowser © Canon	ZbThumbnail.info

Forensic version:	Download demo	Buy now
Professional version:	Download demo	Buy now
Lite version:	Download demo	Buy now