Thumbcache Database

Location

Description

Per-user thumbnail cache databases storing preview images of files that were displayed in Windows Explorer. Multiple databases exist for different thumbnail sizes (32, 96, 256, 1024, etc.).

Forensic Value

Thumbcache entries persist after the original files are deleted, providing visual evidence that specific files existed on the system. In insider threat and data theft cases, thumbnail previews can prove that sensitive documents, images, or other files were present even when the originals have been wiped. The thumbcache_idx.db index maps cache entries to file paths for attribution.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target ThumbCache

thumbcache_viewer.exe (GUI - open thumbcache_*.db files for visual inspection)

Copy-Item "C:\Users\*\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db" -Destination C:\output\ThumbCache\

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References