Does anyone know if there is a thumbnail database on OS X?
Some googling around hasnt uncovered much except for the files in the following path "/private/var/folders/{short-string}/{long-string}/{shorter-string}/com.apple.QuickLook.thumbnailcache"
Although looking at it on my system it doesnt look like anything i recognise.
looking at the index.sqlite file in the folder mentioned above it looks like this is the place where it would likely be found
there's a file called thumbnail.data but i cant recognise anything in it.
the index.sqlite does seem to indicate where the thumbnail might begin and its length; at the very least it seems to show the date/time (in mac absolute time) that the thumbnail was viewed
You can use Scalpel to carve out thumbnailcache files.
Yep. You can probably carve out the thumbcache files. My problem however is parsing the thumbcache file. I've had a look inside and there aren't any recognisable headers. I also did a scalpel carve for known osx and known standard image files
The only other thing I can think of is that the thumbnails are compressed before they're added to the file