Install and Open the Thumbnail Cache Viewers

Download the two projects separately because they use different executables and parse different database families. Record the download source, filename, architecture, version, download time, and SHA-256 before extracting either archive.

Current release details can change

The project pages list separate 32-bit and 64-bit downloads and the Visual C++ 2008 runtime requirement. Verify the current release and requirements on the authoritative pages when you build or update a workstation.

Prepare Thumbs Viewer

1. Download Thumbs Viewer from the project page.
2. Extract the archive to C:\Tools\Thumbs Viewer.
3. Record the extracted executable's version and SHA-256.
4. Double click thumbs_viewer.exe to launch the application.

The empty table includes Filename, Entry Size, Sector Index, Date Modified (UTC), and System. The table remains empty until you open a supported database.

Preserved download and extraction screenshot.

Thumbs Viewer opened and ready for a working copy database.

Prepare Thumbcache Viewer

Preserved download and extraction screenshot.

1. Download Thumbcache Viewer (GUI) from the project page.
2. Select the architecture appropriate for the examination workstation.
3. Extract it to C:\Tools\Thumbcache Viewer.
4. Record the executable's version and SHA-256.
5. Double click thumbcache_viewer.exe to launch the application.

Its table exposes cache entry offsets, sizes, data offsets and sizes, checksums, entry hashes, filenames, dimensions, and system information where available.

Thumbcache Viewer opened and ready for a verified working copy.

Establish the examination boundary

Source

Record the acquired image, host, user or directory, original database path, collection method, and source SHA-256.

Working copy

Copy the database to controlled storage, calculate SHA-256 independently, and confirm it matches the protected copy before opening it.

Output

Create a case labelled export folder outside the source. Never export recovered images back into an evidence directory.

Get-FileHash -Algorithm SHA256 'E:\Cases\SUSA-083\source\Thumbs.db'
Get-FileHash -Algorithm SHA256 'E:\Cases\SUSA-083\working\Thumbs.db'

Do not examine the live cache in place

A live user's cache may be locked or changed by Windows and applications. Use an authorised acquisition and a verified working copy; preserve the acquisition copy unchanged.

Opening check

If the source is named…	Open it with…	Preserve this context
Thumbs.db, ehthumbs.db, Image.db, or another listed legacy database	Thumbs Viewer	Original folder and volume context
thumbcache_256.db, another thumbcache_*.db, or iconcache_*.db	Thumbcache Viewer	User profile, cache family, and related databases

PreviousThumbnail Cache Viewers overviewNextAnalyse and export