±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Jobs
±Latest Webinars
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
SM-920C Thumbnail Image file
SM-920C Thumbnail Image file
Posted: Sat Aug 11, 2018 6:12 am
I am working on a Samsung SM-N920C device that I was able to collect data from the phone using Cellebrite (Physical Extraction).
I am trying to investigate some pictures, which are in thumbnails. The pictures are not available elsewhere?
The pictures locations are "Media/0/DCIM/.thumbnails/1512492855362.jpg"
I need to know from where this pictures came from?
The picture is taken by Camera or not? No metadata is available, Second can we define any relationship between original picture and thumbnail picture?
i means is there any chance to get original picture name and timestamp.
Does anyone have any thoughts on the picture and its location?
I am trying to investigate some pictures, which are in thumbnails. The pictures are not available elsewhere?
The pictures locations are "Media/0/DCIM/.thumbnails/1512492855362.jpg"
I need to know from where this pictures came from?
The picture is taken by Camera or not? No metadata is available, Second can we define any relationship between original picture and thumbnail picture?
i means is there any chance to get original picture name and timestamp.
Does anyone have any thoughts on the picture and its location?
-
Arbab - Member
Re: SM-920C Thumbnail Image file
Posted: Mon Aug 20, 2018 5:34 am
I'll try to help
Path
Media/0/DCIM/.thumbnails/1512492855362.jpg
1) Media/0/DCIM
This is the default storage area for images taken by the device camera.
2)Media/0/DCIM/.thumbnails/
Once an image taken by the camera is taken and is stored in the default location the Android OS creates a Thumbnail of the image in the above path (Media/0/DCIM/.thumbnails/)
The thumbnail is given a UNIX epoch time stamp (milliseconds) name
as in 1512492855362.jpg
This converts to 05/12/2017, 16:54:15 GMT
If the original images has been deleted or moved the thumbnail will remain in the thumbnail folder(Media/0/DCIM/.thumbnails/)
However without the original Image this is a very basic interpretation of the remaining data
Kind regards
Paul
Path
Media/0/DCIM/.thumbnails/1512492855362.jpg
1) Media/0/DCIM
This is the default storage area for images taken by the device camera.
2)Media/0/DCIM/.thumbnails/
Once an image taken by the camera is taken and is stored in the default location the Android OS creates a Thumbnail of the image in the above path (Media/0/DCIM/.thumbnails/)
The thumbnail is given a UNIX epoch time stamp (milliseconds) name
as in 1512492855362.jpg
This converts to 05/12/2017, 16:54:15 GMT
If the original images has been deleted or moved the thumbnail will remain in the thumbnail folder(Media/0/DCIM/.thumbnails/)
However without the original Image this is a very basic interpretation of the remaining data
Kind regards
Paul
-
pcook8198 - Member
Re: SM-920C Thumbnail Image file
Posted: Mon Aug 20, 2018 12:53 pm
You original file was deleted, renamed or moved. Do it the other way around, carve for all images, even if partial, then do a match on the time stamps to figure the original file. I would also check the content of any memory cards used in the device, if available
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny!

_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny!
-
passcodeunlock - Senior Member