±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 36209
New Yesterday: 7 Visitors: 169

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

OS X Thumbnail Database

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

randomaccess
Senior Member
 

OS X Thumbnail Database

Post Posted: Jun 05, 13 14:30

Does anyone know if there is a thumbnail database on OS X?

Some googling around hasnt uncovered much except for the files in the following path: "/private/var/folders/{short-string}/{long-string}/{shorter-string}/com.apple.QuickLook.thumbnailcache"

Although looking at it on my system it doesnt look like anything i recognise.  
 
  

randomaccess
Senior Member
 

Re: OS X Thumbnail Database

Post Posted: Jun 06, 13 05:21

looking at the index.sqlite file in the folder mentioned above it looks like this is the place where it would likely be found

there's a file called thumbnail.data but i cant recognise anything in it.
the index.sqlite does seem to indicate where the thumbnail might begin and its length; at the very least it seems to show the date/time (in mac absolute time) that the thumbnail was viewed  
 
  

zekituredi
Member
 

Re: OS X Thumbnail Database

Post Posted: Jun 07, 13 14:47

You can use Scalpel to carve out thumbnailcache files.  
 
  

randomaccess
Senior Member
 

Re: OS X Thumbnail Database

Post Posted: Jun 09, 13 14:43

Yep. You can probably carve out the thumbcache files. My problem however is parsing the thumbcache file. I've had a look inside and there aren't any recognisable headers. I also did a scalpel carve for known osx and known standard image files

The only other thing I can think of is that the thumbnails are compressed before they're added to the file  
 

Page 1 of 1