Join Us!

OS X Thumbnail Data...
 
Notifications
Clear all

OS X Thumbnail Database  

  RSS
randomaccess
(@randomaccess)
Active Member

Does anyone know if there is a thumbnail database on OS X?

Some googling around hasnt uncovered much except for the files in the following path "/private/var/folders/{short-string}/{long-string}/{shorter-string}/com.apple.QuickLook.thumbnailcache"

Although looking at it on my system it doesnt look like anything i recognise.

Quote
Posted : 05/06/2013 3:30 pm
randomaccess
(@randomaccess)
Active Member

looking at the index.sqlite file in the folder mentioned above it looks like this is the place where it would likely be found

there's a file called thumbnail.data but i cant recognise anything in it.
the index.sqlite does seem to indicate where the thumbnail might begin and its length; at the very least it seems to show the date/time (in mac absolute time) that the thumbnail was viewed

ReplyQuote
Posted : 06/06/2013 6:21 am
zekituredi
(@zekituredi)
New Member

You can use Scalpel to carve out thumbnailcache files.

ReplyQuote
Posted : 07/06/2013 3:47 pm
randomaccess
(@randomaccess)
Active Member

Yep. You can probably carve out the thumbcache files. My problem however is parsing the thumbcache file. I've had a look inside and there aren't any recognisable headers. I also did a scalpel carve for known osx and known standard image files

The only other thing I can think of is that the thumbnails are compressed before they're added to the file

ReplyQuote
Posted : 09/06/2013 3:43 pm
Share: