I've crawled this forum, internet and Encase books for info, but very little is mentioned on thumbs.db.
Last modified on files within thumbs.db Does it represent the actual viewing of each image within the last modified? Also, how does the thumbs.db actually get updated, by batch, or loads individual files one at a time?
I need an actual white paper, preferably detailing the above and any additional info on detailed workings of thumbnails.
Regards,
Having found myself in this position I found the best approach was to try to establish the answer myself by a bit of experimentation. It didn't take long to get a few picture files and move them around, monitoring the creation and modification of the thumbs.db database as I did so. I've kept my own notes for court purposes so I can answer any related questions based on my own knowledge.
In short the times and dates relate to the database as opposed to the pictures featured. The database only gets created when the thumbnail view for that folder in Explorer is first activated and thumbnails for any new pictures only get created when the thumbnail view is next used (at least that's what I found).
I do recall Access Data having a white paper on the subject.
Have you mounted and viewed the file sructure of these thumbs.db files within EnCase?
I have noted that in a quick experiment I just did each of the files has a last written date. I'm just going to have to assume that this relates to the date the thumb nail was generated without further research at the moment
Yes, within Encase.
I did the same test, last written representing the date the thumbnail image is created, therefore viewed. But, individual testing is not the best evidence really. If anyone knows of a white paper, would be appreciated!#
I saw that paper Jerry, it didn't mention last modified or much about the details really.