Thumbcache Version 2

If anyone has been to one of Ovie Carroll's recent presentations on Vista you will probably have heard mention of this program. It was also mentioned during my interview on cyperspeak. This is a rewrite to the program that was written for this blog entry. This program will read either a directory where the thumbcache_*.db files are or the individual thumbcache files, if you happen to pull the thumbcache_*.db files out make sure you include the thumbcache_idx.db file, this will add a date/timestamp to the reports for each picture extracted. This program will not only read the thumbcache and export the files but it will also create a nice/professional report to pass along to someone. You can also copy the whole directory and burn it to a CD and the reports will still display everything correctly.

The program an be found here . This program is a little different as I have started playing with the NSIS installer. The installer will ask you to input your name, agency name and a location for your organization's logo. This information is used for the reports to give that professional look. If you do not fill the information in then they will be a few blank spots on the reports.

As Always Questions/Comments/Suggestions/Etc....

Calling Thumbcache Parser from X-Ways Forensics...

I saw a post on the x-ways forums about carving out data from the thumbscache and thought to myself now why did I not think of making my thumbcache parser able to be called from x-ways. Well now you can. I made a few small modifications to the program and you can now call if from x-ways forensics by right clicking on one of the thumbcache files and picking an external program.

To install it download the zip file from here . Unzip in to the directory of your choice. Take the headersig.txt and put that in the temp folder you have defined in x-ways forensics (this is under options=>general, if you do not do this the program will not work and will just hang). Now define the EXE or perl script (your choice) in the external programs definition section (options=>external programs). That is all that is needed to set it up. To run it right click on one of the thumbcache_??.db files and pick the external program to run. The program will then ask you where you want to put the jpg/bmp/png files that will be exported from the thumbcache file. Once the program has finished you can then import the files into your case.

As always I hope you find this useful. Questions/Comments/Suggestions?

Thumbs Up To Ovie......

On the Sept 23 podcast of Cyberspeak Ovie Carroll talked about the thumbs cache that is new in Windows Vista. In response I have created a perl script with a autoit gui front end that will parse all 4 of the thumbcache files.

The base program is based on the sigs.pl script originally written by Harlan Carvey. What the perl script does is open the specified thumbscache files and then scans for file header signatures. Once it finds a jpg, png or bmp file header it then backs up and reads what I will call the file header record of that image file. In this record is the size and internal name of the file. I have not figured out how it gets that particular name but if someone knows please let all of us know. The thumbcache_32 and 96 files appear to only contain bmp files while the thumbcache_256 and 1024 contain png and jpg's. For all the gory details see the perl code.

Since the thumbcache files I had were very limited this is about as much as I know. As for the gui just pick the file you want to parse, input the directory with a "\" as the end where the thumbcache files are and input a directory to write all the images to and click on the parse button and watch it go.

Now since this does not use any windows specific perl modules there is no reason that you cannot run it on Linux or a Mac. The code and executable can be found here.

Thanks to Ovie for the idea for this program. Ovie and Bret keep up the great work on the podcast.

As always questions/comments/thoughts/problems let me know. My eyes and ears are always looking for great new projects.