Hi All,
I have seen a couple of threads that touch on but don't really answer my question.
I have a CAM case where the user has run Cleaning tools on a regular basis, but I have found 4 references to illegal content in the path under the Local Settings\Media Player\Art Cache\LocalMls.
I have found a large number of thumbnail images in there (including the 4 I mentioned). I get that it is the album art cache for the albums accessed by the media player. What I'm trying to find out is how this data is populated.
eg is it proof the file was played by the user, or added to the file library or some other user action.
Any insight greatly appreciated,
cheers
I have done some testing with this today for something I am working on.
I noticed the Local Settings\Media Player\Art Cache\LocalMLS, is populated when Window Media updates the library with a video.
To expand on this.
Windows Media player already has one video file (wildlife) by default in it library; however the LocalMLS folder is empty (I have not used WMP before today).
I viewed this movie, viewed a video file from the internet and from a USB stick in WMP.Although I have played these movies in the WMP software the LocalMLS folder remains empty.
I then copied a video to the 'My video' Folder. WMP was still open at this point and automatically started to update the library to included the new video file.
At this point I then refreshed the LocalMLS folder and a thumbnail image of the video I just copied was now created in this folder.
I'm sure there may be other ways in which this folder is populated with images but this is what I have came across so far.
Hope that helps
I too did some research as to how this folder is populated. What I found is that all you had to do was open a video file in Media player and it put a jpg image of the opening scene in the Art Cache/LocalMLS folder. As you may have noticed the jpg image is just that and is not the WMV or movie file. It can not be played from this location.
Even if you delete the original file the jpg image remains in that folder until deleted from that specific folder. I spent several hours playing with this. The other thing I found is if the video is not stored in either My Documents/ My Pictures or My Videos folders it will not automatically populate Windows Media Player and will not populate the LocalMLS folder. It will only populate the Art Cache/LocalMLS folder when the video is opened in Media player. It didn't seem to matter how long I played the video either. If I only played a few seconds of it, it sill put a jpg image in the LocalMLS folder.
From a Forensic point of view, depending on local laws, just because you have an image in this folder does not prove intent to posses. It merely means somewhere along the line you opened a video file in WMP. Using FTK Imager I was able to see that the original file had been created, accessed, modified and deleted with the same dates and times telling me that the file had been opened but was immediately deleted.Also during an examination of a hard drive I found that sometimes this folder will create multiples of the same image. I am not sure at this time why but all had the same created, accessed and modified dates leading me to believe it wasn't because it was opened and viewed multiple times. This may happen when WMP is updated to a newer version then updates the LocalMLS file. More research.