Thumbcache Viewer is an open-source application for Windows that allows you to extract and view thumbnail images from the thumbnail and icons cache files created by Windows File Explorer. These cache files are created by Windows File Explorer on Windows Vista, 7, 8.1 and 10. Usually these files are named in the format of thumbcache_*.db and iconcache_*.db.
These cache files are nothing but a database of all the thumbnail images generated by File Explorer. Even if the user deletes the original pictures from a folder, the thumbnails cache database is not readily changed. Therefore, we can analyze these databases for some of the files that existed on a storage drives. It is useful if you want to examine the kind of pictures or icons that a user has been accessing for the forensic purposes.
Thumbcache Viewer comes in two versions – one with GUI and another in CLI version. The GUI version is obviously much easier to use for the Windows users as we can quickly see the contents of the thumbnails cache database files but also view them in a small preview window.
As soon as we open a thumbnails cache or icons cache database in Thumbcache Viewer, it produces a list of all the files. In the list of all the images, we can see the name of the file, the data offset, cache entry offset, data entry size, data checksum, header checksum, cache entry hash, system version, and the location of the database file.
When you select a file in the list of all the images, it will display a preview of that file in a small preview window. We can always right-click on an image file and choose Save Selected to save that image to a folder of your choice. There are options to view the extended information about those files.
The CLI version of Thumbcache Viewer can be used to quickly extract the thumbnail images to a folder. As expected, it does not offer any previews of the images. But it does offer many command line parameters that allow for generating of HTML and CSV reports.
You can download Thumbcache Viewer from https://thumbcacheviewer.github.io/.