Monday, October 15, 2007

Thumbs Up To Ovie......

On the Sept 23 podcast of Cyberspeak Ovie Carroll talked about the thumbs cache that is new in Windows Vista. In response I have created a perl script with a autoit gui front end that will parse all 4 of the thumbcache files.

The base program is based on the sigs.pl script originally written by Harlan Carvey. What the perl script does is open the specified thumbscache files and then scans for file header signatures. Once it finds a jpg, png or bmp file header it then backs up and reads what I will call the file header record of that image file. In this record is the size and internal name of the file. I have not figured out how it gets that particular name but if someone knows please let all of us know. The thumbcache_32 and 96 files appear to only contain bmp files while the thumbcache_256 and 1024 contain png and jpg's. For all the gory details see the perl code.

Since the thumbcache files I had were very limited this is about as much as I know. As for the gui just pick the file you want to parse, input the directory with a "\" as the end where the thumbcache files are and input a directory to write all the images to and click on the parse button and watch it go.

Now since this does not use any windows specific perl modules there is no reason that you cannot run it on Linux or a Mac. The code and executable can be found here.

Thanks to Ovie for the idea for this program. Ovie and Bret keep up the great work on the podcast.

As always questions/comments/thoughts/problems let me know. My eyes and ears are always looking for great new projects.

8 comments:

Ben Vanik said...

Not to revive a long dead post, but I was just looking around for this. I reverse engineered the thumbcache_idx.db and thumbcache_*.db files, but the last thing that I haven't yet figured out is the 8 byte IDs - I have no idea how to get from a filename to the ID. Did you ever figure this out?

Mark McKinnon said...

Noxa,

I have never figured it out. I am not sure you can get to a filename though it would be nice. I would love to here what you have for the thumbcache_idx.db file as I have not had a chance to check that one out yet.

Mark

Ben Vanik said...

I've put everything I learned up in my blog. Enjoy!

Anonymous said...

Well, what does it all mean? Simply put, an illegal Viagra UK hawker, who provides you nothing about the drug mechanisms, benefits, side effects, dosages, storage information and other vital information that are a 'must-know' for a Viagra online user can occupy the top rank in Viagra pills search for google, yahoo or msn, by employing the search engine optimization techniques.

escorts espaƱa said...

Thanks so much for this post, pretty helpful data.

sports handicapping software said...

I love the way the people here interact and shared their opinions too. I would love to track your future posts pertaining to the said topic we are able to read.

pay per head said...

I really love this post. Its really a great information in this blog. Keep it up.

hermes birkin grey said...

Great Article it its really informative and innovative keep us posted with new updates. its was really valuable. thanks a lot.