SUSA-083 / THE MISSING PLAN: SYNTHETIC TRAINING ONLY
All images and databases were constructed for this lab; none was acquired from a real person or host.
Fictional brief: WIN11-LAB01 is associated with a reported removable drive of building plans.
Source A: removable drive image USB-01, E:\Plans\Thumbs.db (legacy XP/2003 format).
Source B: host image WIN11-LAB01-01, C:\Users\alex\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db (Windows 7 format).
The older format is a training choice, not proof WIN11-LAB01 created either database.
Acquisition method: constructed fixtures, not a forensic acquisition. No original image/volume is supplied.
Question: do both caches contain a NORTH WING preview? Do not infer a viewing time or actor.
Only cache content and this fictional brief are provided. No Search, MFT, LNK or event evidence is included.
Thumbs.db has three named PNG entries. thumbcache_256.db has three PNGs and one empty entry.
No original plan image is supplied outside the caches. Export previews with the real viewers.
