Windows 7 thumbcach...
 
Notifications
Clear all

Windows 7 thumbcache_idx.db

2 Posts
2 Users
0 Reactions
1,247 Views
(@ercompfor)
Active Member
Joined: 14 years ago
Posts: 5
Topic starter  

I was wondering if anyone had any insight into the thumbcache_idx.db file in Windows 7. In Windows Vista, you could determine the last modified date/time. That appears to have changed in Windows 7. The 8 byte value for date/time was replaced with another 8 byte value, but I can't find any information as to what that value represents.


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

I was wondering if anyone had any insight into the thumbcache_idx.db file in Windows 7. In Windows Vista, you could determine the last modified date/time. That appears to have changed in Windows 7. The 8 byte value for date/time was replaced with another 8 byte value, but I can't find any information as to what that value represents.

Harry Parsonage epublished a paper (JFYI)
http//computerforensics.parsonage.co.uk/downloads/UnderMyThumbs.pdf

but that question (which is also there) is AFAIK still without an answer. (

According to this thesis by Sarah Morris
https://dspace.lib.cranfield.ac.uk/bitstream/1826/8034/1/SLAMorris%20Final%20Thesis%20After%20Corrections.pdf
the field is just a sort of "unique" ID in Windows 7.

jaclaz


   
ReplyQuote
Share: