OS X Thumbnail Data...
 
Notifications
Clear all

OS X Thumbnail Database

4 Posts
2 Users
0 Likes
784 Views
(@randomaccess)
Posts: 385
Reputable Member
Topic starter
 

Does anyone know if there is a thumbnail database on OS X?

Some googling around hasnt uncovered much except for the files in the following path "/private/var/folders/{short-string}/{long-string}/{shorter-string}/com.apple.QuickLook.thumbnailcache"

Although looking at it on my system it doesnt look like anything i recognise.

 
Posted : 05/06/2013 2:30 pm
(@randomaccess)
Posts: 385
Reputable Member
Topic starter
 

looking at the index.sqlite file in the folder mentioned above it looks like this is the place where it would likely be found

there's a file called thumbnail.data but i cant recognise anything in it.
the index.sqlite does seem to indicate where the thumbnail might begin and its length; at the very least it seems to show the date/time (in mac absolute time) that the thumbnail was viewed

 
Posted : 06/06/2013 5:21 am
(@zekituredi)
Posts: 16
Active Member
 

You can use Scalpel to carve out thumbnailcache files.

 
Posted : 07/06/2013 2:47 pm
(@randomaccess)
Posts: 385
Reputable Member
Topic starter
 

Yep. You can probably carve out the thumbcache files. My problem however is parsing the thumbcache file. I've had a look inside and there aren't any recognisable headers. I also did a scalpel carve for known osx and known standard image files

The only other thing I can think of is that the thumbnails are compressed before they're added to the file

 
Posted : 09/06/2013 2:43 pm
Share: