Thumbnail Cache Viewers Hands on Labs

Choose the Interactive Lab for a guided investigation with both simulated interfaces and no installation. Use the Full Lab with the downloadable training pack and both real viewers to save previews, record their source details and write a finding.

Interactive Lab

Find a missing building plan preview in two recovered caches. Open each working copy, inspect the rows, save the image and CSV, then write a short case note. Follow Next action above the viewer. It changes after each action. The checklist shows what you have finished. Click Next task when it becomes available. Open Show hint for the exact file or menu to choose.

The browser lab uses fictional records and selected controls from Thumbs Viewer and Thumbcache Viewer. It records simulated image and CSV saves. Download case note saves your findings as a text file.

Full Lab

Windows VM / real viewers

Thumbnail Cache Viewers Full Lab

Three guided activities

Case SUSA-083 / the missing plan

Find the plan. Keep the clues. Explain the limits.

The original building plan is missing from your team's collected files. Can two thumbnail caches still show its layout? Use both real viewers to find the NORTH WING preview, save it with its record details, and leave a short finding for the next analyst.

Beginner · allow 30 to 45 minutes after setup. Open one step at a time. Each activity ends with a small result you can save. You can start here without completing the browser lab.

Tick a checkpoint after saving its evidence. This browser remembers your ticks; the page cannot check your VM or files.

Investigation brief

Case questionDo both caches contain a preview consistent with the north wing plan?

Your evidence

A folder level Thumbs.db, a per user thumbcache_256.db, a source context note, a SHA-256 manifest and a case worksheet.

Real case note: These are constructed training databases with fictional source context, not an acquisition from a person or computer. You will parse real binary files and save real exports. In DFIR work, use verified copies from the authorised drive or host image and retain the acquisition record.

Before you start

Need: a Windows training VM, Windows PowerShell 5.1, and both GUI viewers installed. Use C:\Tools\Thumbs Viewer\thumbs_viewer.exe and C:\Tools\Thumbcache Viewer\thumbcache_viewer.exe, or adjust the tool paths below. Administrator access is not needed for examination; choose writable case storage.

Download: SUSA-083 training pack. Save it in the VM's Downloads folder under that filename. It includes two caches and notes; no executable or malware is included. The browser simulation uses different example records, so its identifiers and counts will differ.

Follow: use the same PowerShell window for the command blocks. Write your results in notes\handover.txt, created in Activity 1. A hash is a file fingerprint: matching SHA-256 values confirm that the copies match. Keep the case folder outside the VM before restoring a snapshot.

What is supplied, and what is deliberately missing?

source-context.txt describes fictional removable drive image USB-01 and host image WIN11-LAB01-01, profile alex. The folder level cache uses an XP/2003 format; the user cache uses a Windows 7 format. An older database can be recovered on newer media: its format does not prove which computer created it. Here both formats were constructed for training.

The pack contains no original plan, disk image, Windows Search database, file system records or shortcuts. Planning a corroboration check is part of the core lab; performing one is optional with additional evidence. instructor\expected-results.json is an answer key, not independent evidence. Try the examination before opening it.

Activity 1: Prepare the case

Your first winCreate two verified working copies and a place for your findings.

1. Unpack and verify the training evidence

Open Windows PowerShell in the training VM. This checks the files against the supplied manifest, creates separate working and export folders, and copies the worksheet. Use a new case path if you have completed the lab before; it stops rather than overwriting a case.

$thumbCase = 'C:\Cases\SUSA-083'
$thumbZip = Join-Path $env:USERPROFILE 'Downloads\SUSA-083-training.zip'
if (-not (Test-Path -LiteralPath $thumbZip)) { throw 'Save the training ZIP in Downloads first.' }
if (Test-Path -LiteralPath $thumbCase) { throw 'Case folder exists. Choose a new case path.' }
Expand-Archive -LiteralPath $thumbZip -DestinationPath $thumbCase -ErrorAction Stop
foreach ($item in (Import-Csv -LiteralPath "$thumbCase\manifest.csv")) {
    $file = Join-Path $thumbCase $item.Path
    if ((Get-FileHash -Algorithm SHA256 -LiteralPath $file -ErrorAction Stop).Hash -ne $item.SHA256) {
        throw "Manifest mismatch: $($item.Path). Stop and download a fresh pack."
    }
}
'Training pack manifest: all files match'
'working', 'exports\thumbs', 'exports\thumbcache', 'notes' | ForEach-Object {
    New-Item -ItemType Directory -Path (Join-Path $thumbCase $_) -ErrorAction Stop | Out-Null
}
Copy-Item -LiteralPath "$thumbCase\source\Thumbs.db", "$thumbCase\source\thumbcache_256.db" -Destination "$thumbCase\working" -ErrorAction Stop
Copy-Item -LiteralPath "$thumbCase\case-worksheet.txt" -Destination "$thumbCase\notes\handover.txt"
Get-FileHash -Algorithm SHA256 -LiteralPath "$thumbCase\source\Thumbs.db", "$thumbCase\working\Thumbs.db", "$thumbCase\source\thumbcache_256.db", "$thumbCase\working\thumbcache_256.db" |
    Export-Csv -LiteralPath "$thumbCase\notes\database-hashes.csv" -NoTypeInformation
Import-Csv -LiteralPath "$thumbCase\notes\database-hashes.csv" | Format-List

Look for: the manifest confirmation and four hash records. Compare each source with its same named working copy: each pair must match. A manifest checks consistency with this pack; it does not authenticate a real acquisition. Leave source unchanged and open only files under working in the viewers.

Open source-context.txt and notes\handover.txt in Notepad. Copy the context into the worksheet and add your name, examination date and time zone. Label the supplied context fictional training context.

2. Choose and record the two viewers

Predict the right viewer for each filename, then check: Thumbs Viewer opens Thumbs.db; Thumbcache Viewer opens thumbcache_256.db. Launch both. In Help > About, record each displayed version in the worksheet. Add the project URL and executable path. Save the executable fingerprints:

Get-FileHash -Algorithm SHA256 -LiteralPath 'C:\Tools\Thumbs Viewer\thumbs_viewer.exe', 'C:\Tools\Thumbcache Viewer\thumbcache_viewer.exe' -ErrorAction Stop |
    Export-Csv -LiteralPath "$thumbCase\notes\viewer-hashes.csv" -NoTypeInformation

Look for: two open viewers and viewer-hashes.csv with two records. An empty viewer is normal until you open a database. If an app will not start, return to Install and open.

Ready to examine I verified the manifest and both source/working hash pairs, and saved the source context. I opened both viewers and recorded their versions, paths, sources and executable hashes.Pause here: keep the case folder. In a new PowerShell window, set $thumbCase = 'C:\Cases\SUSA-083' again (or use your chosen path).

Next: find the north wing layout in the two working copies.

Find the plan ›

Activity 2: Find and save the plan

Your next winRecover one matching preview from each cache with a table of its record details.

Make your prediction

Will the second cache give you the original filename? If the pictures look alike, must their file hashes match? Keep your prediction for Activity 3.

1. Find NORTH WING in Thumbs Viewer

1. In Thumbs Viewer, choose File > Open and select C:\Cases\SUSA-083\working\Thumbs.db (or your chosen case path).
2. Record the row count and System. Click each filename to preview it in the separate image window. Find NORTH WING; check its label and room layout against the other wing.
3. In the worksheet, record the selected Filename, Entry Size, Sector Index and exact Date Modified (UTC). The displayed date is not a viewing time.
4. Keep the matching row selected. Choose File > Save Selected, browse to exports\thumbs in your case, and save the preview. Then choose File > Export to CSV and save the table as exports\thumbs\thumbs.csv.

Look for: three named rows, one NORTH WING preview, one saved PNG and a nonempty CSV. Open both exports to check them. Saving an image does not save its surrounding record details, which is why you keep the table too.

Hint: which record and what should I see?

The plan is north-wing.png, showing NORTH above WING and a four room outline. It is 128 × 128 pixels. The table reports the XP/2003 format. A sector index locates an entry inside the database; preserve the displayed value, including SSAT if shown. It is not an original file path.

2. Find the same layout in Thumbcache Viewer

1. Choose File > Open and select the working thumbcache_256.db. Record four rows before filtering and the displayed System.
2. Preview the image bearing rows and find NORTH WING. Record its Cache Entry Hash, Filename, Cache Entry Offset, Data Offset and Data Size. A filename generated from an identifier is not an original file path.
3. Choose View > Hide Blank Entries. Record the new count and filter setting. This hides the zero data row; it does not delete it from the database.
4. Choose Tools > Verify Checksums. Record the actual result, including any mismatch. These CRC-64 checks test consistency of stored record data and headers; they do not identify an original file or user.
5. Reselect the plan. Choose File > Save Selected and save under exports\thumbcache. Choose File > Export to CSV and save exports\thumbcache\thumbcache.csv. Note whether the CSV includes the hidden blank row; preserve it as produced.

Look for: three visible rows after filtering, the NORTH WING preview, a checksum result, a PNG and a nonempty CSV. Open both exports. Location identifies the database opened by the viewer, not the original plan path.

Hint: identify the matching entry

The target's Cache Entry Hash is 7f3a0000000091c1. Its preview is 256 × 256 pixels and the viewer reports Windows 7. The supplied records have valid header and data checksums. Do not record “valid” until you run verification. If your result differs, check the working copy and retain the warning.

3. Fingerprint the four exported files

Run this after both viewers' saves. Keep the hash list under notes, outside the folders it describes.

Get-ChildItem -LiteralPath "$thumbCase\exports\thumbs", "$thumbCase\exports\thumbcache" -File |
    Get-FileHash -Algorithm SHA256 |
    Export-Csv -LiteralPath "$thumbCase\notes\export-hashes.csv" -NoTypeInformation
Import-Csv -LiteralPath "$thumbCase\notes\export-hashes.csv" | Format-List

Look for: four records: one PNG and one CSV from each viewer. Recheck your output folders if anything is missing. SHA-256 identifies a whole exported file; it differs from the viewer's Cache Entry Hash and CRC-64 fields.

Two previews preserved I saved the Thumbs Viewer plan, CSV and selected record details. I saved the Thumbcache Viewer plan, CSV, identifiers, filter/checksum result and all four output hashes.Pause here: your saved previews, tables and worksheet are enough for Activity 3. You can close both viewers.

Next: compare the previews and decide what you can support.

Make your finding ›

Activity 3: Compare and explain

Your final winGive another analyst a finding they can check against the saved records.

1. Compare appearance with file identity

Open both exported PNGs. Compare the NORTH WING label and room layout. In Windows File Explorer, right click each PNG, choose Properties > Details, and record the dimensions. Compare their SHA-256 values in notes\export-hashes.csv.

Look for: the same layout at 128 × 128 and 256 × 256 pixels, with different SHA-256 values. They are visually consistent, but are different files. A cached preview is a reduced representation; matching content does not establish the original document's hash, complete contents or current existence. Revisit your prediction from Activity 2.

2. Choose a defensible finding and save your note

Make your callBoth previews show NORTH WING, but their SHA-256 values differ. Which finding can you support?

Alex opened the original plan at the displayed Date Modified time.Both caches contain previews consistent with the north wing layout; the exports are different files.Different hashes mean the previews cannot show the same plan.

Choose a finding, then use your own saved record details in the worksheet.

Finish notes\handover.txt. Keep these four parts short:

• Observation: name each database, selected entry and exported filename. Describe the layout, dimensions, hash comparison and actual checksum result.
• Interpretation: both records contain a preview consistent with the reported plan. The legacy cache does not establish that WIN11-LAB01 created it.
• Limitations: separate fictional source context from observed data. Neither preview alone proves the original path, actor, precise viewing time, intent or whether the original still exists. No corroborating artefacts were supplied.
• Next check: choose one source and explain what you would test. For example, examine the acquired profile's Windows Search database for this entry identifier to seek a path; validate any candidate with file system evidence. Record this as planned, not performed.

Look for: a short note citing your actual records and outputs, with no invented path or activity time. Answering the browser question never ticks the VM evidence checkpoints for you.

Example wording to adapt after recording your results

“The two examined training caches contained previews consistent with the NORTH WING layout. The Thumbs Viewer export was 128 × 128 pixels; the Thumbcache Viewer export was 256 × 256. Their SHA-256 values differed. Selected identifiers, source hashes, tool versions and exports are recorded in this case folder. This establishes cached preview content within the synthetic exercise, not a viewing action by Alex or an original file path. Windows Search mapping is a planned next check; no Search database was provided.”

Use your actual results if they differ. Clearly reported failure or missing data is more useful than copying an expected result.

Case closeout3. Reproduce one export and hand over

Reopen one working database, locate the entry from your worksheet, and save it to a new exports\recheck folder. Hash that image with Get-FileHash -Algorithm SHA256 -LiteralPath 'your exported image path' and compare it with the first export. Ask a partner to do this if available; alone, follow only your notes. Record whether the hash matches and fix any missing instructions.

Look for: the same image bytes from the same selected entry, or a documented reason for a difference. Keep the recheck output and result. Recalculate both source database hashes and compare with notes\database-hashes.csv to confirm the retained sources are unchanged.

Copy the complete case folder to controlled storage outside the VM and open the copied note, images and tables. Close the viewers before reverting a disposable snapshot. Retain the sources, manifest, outputs and notes together; no deletion commands are needed.

Ready for another analyst I saved the comparison and a bounded finding, with limitations and one planned corroboration check. I reproduced an export, rechecked the source hashes and opened the complete handover copy outside the VM.Completion follows your saved evidence, including clearly described gaps. Keep optional mapping separate from the core result.

Finish with a note another analyst can verify from your files.

Review the evidence checklist ›

Full Lab evidence checklist

Case folder handoverSave the two checkpoints in each activity.

• 1Context and integritysource/, working/, manifest.csv, source-context.txt, database and viewer hashes, and recorded tool versions.
• 2Two selected recordsOne plan PNG and CSV per viewer under exports/, selected metadata, filter/checksum results, and notes/export-hashes.csv.
• 3Finding and handovernotes/handover.txt, comparison, a planned next check, reproduction result and a checked copy outside the VM.

You have completed a small DFIR workflow: verify, examine, preserve and explain. The blank worksheet is also available separately.

Troubleshooting: missing rows, previews, checksums or exports

What you see	What to check
Case folder already exists	Use a new case path and update $thumbCase. Keep previous work.
Manifest or copy mismatch	Stop. Preserve the error, use a fresh download in a new folder and repeat the checks.
Database will not open	Check the working path, viewer/database pairing and hashes. Expect three legacy rows and four unfiltered modern rows.
One row has no image	The modern cache has one deliberate zero data entry. Select an image bearing row; note the count before hiding blanks.
Wrong plan	Compare NORTH/SOUTH labels and layout. Reselect NORTH WING before Save Selected.
Checksum mismatch	Retain the message and affected record. Recheck the working copy hash and viewer version. Do not silently discard a damaged record.
Only one saved output	Save Selected and Export to CSV are separate operations. Check the destination and open both files.
CSV still includes a blank row	Record the exported count and filter state. A display filter need not restrict a full table export.
A field is absent	Preserve the exact fields provided and record the gap. Do not invent dates, dimensions or paths.

Optional extension: test a path with additional evidence

Use an instructor supplied or authorised cache and its related Windows Search or file system evidence. This pack has neither original files nor a matching Search database, so scanning the analyst computer will not establish its fictional paths.

Follow the project's mapping guidance for the generating Windows version and analysis environment. Directory scanning must use the system that generated the cache; Search mapping has ESE/SQLite and library requirements. Record the source hash, tool version, query or method, returned path and gaps. Cross check a candidate with file system records. A mapping is a lead, not proof of who viewed a file or why. An absent mapping is not proof the original never existed.

PreviousAnalyse and exportNextReturn to the overview