I used cellebrite to extract data from an Amazon Kindle Fire HD7 and a Motorola e5 Play. Most of the images that are of interest are thumbnails. Was wondering if anyone had any knowledge of the file paths associated with them. They are as follows;
(ExtX)/Root/data/com.amazon.cloud9/cache/Cache/
(ExtX)/Root/media/meVideoplayer/thumb
Play.zip/sdcard/DCIM/.thumbnails/.thumbdata4/.thumbdata4_embedded_413.jpgÂ
Media/Internal shared storage/Android/data/org.videolan.vlc/files/medialib
Play.zip/sdcard/DCIM/.thumbnails/1584267922209.jpgÂ
Â
Thank you for any help with this!
You are basically looking at previews of images/videos/files on your devices. Cache files store data so that future requests for the data can populate faster. its usually a result of some sort of data that has been computed already. kinda like if you are going to a website, the first time you go there, some items may be cached on your device so that the next time you go there, the page loads faster and it only needs to update some things that have changed.
The meVideoplayer likely thumbnailed some portion of a file that was accessed by the player. It would take a bit of testing but I've had other players thumbnail images from an album cover. I had a case where an illicit video contained an album cover of an illicit image. The player had another database that listed the album's name. Same goes with your VideoLan file from VLC. In fact, I know from testing that medialib is from an album cover.
DCIM is Digital Camera IMage which is a standard of camera storage as well as most devices with a camera. On Android devices, the Gallery App will create a .thumbnails directory and/or a .thumbdata4 file. These have to do with the version of Android. Thumbnails are smaller pictures of originals that were on the device to aid the user in Gallery view. The user can delete the original picture but the thumbnails are more persistent. It usually requires the user to manually delete the thumbnail file (or another clearing app) and then Gallery will repopulate the thumbnail file with the existent images of the Gallery. Because the thumbdata4 file is basically concatenated JPEGs about 96x96, it grows in size and can cause storage issues. The '*embedded files from thumbdata4 are actually Cellebrite carving out JPEGs from the parent thumbdata4 file. If you are seeing a thumbnail that the original no longer resides, I'd suggest looking at thumbnails that do have originals and use their metadata to narrow down the timeframe that the deleted file may have been present. Good luck!
