Andrew Frowen offers the following royalty-free article for you to publish online or in print. Feel free to use this article in your newsletter, website, ezine, blog, or forum. ----------- PUBLICATION GUIDELINES - You have permission to publish this article for free providing the "About the Author" box is included in its entirety. - Do not post/reprint this article in any site or publication that contains hate, violence, porn, warez, or supports illegal activity. - Do not use this article in violation of the US CAN-SPAM Act. If sent by email, this article must be delivered to opt-in subscribers only. - If you publish this article in a format that supports linking, please ensure that all URLs and email addresses are active links. - Please send a copy of the publication, or an email indicating the URL to [email protected] - Article Marketer (www.ArticleMarketer.com) has distributed this article on behalf of the author. Article Marketer does not own this article, please respect the author's copyright and publication guidelines. If you do not agree to these terms, please do not use this article. ----------- Article Title: Image Thumbnails In Vista And The Implications For Computer Forensic Investigations Author: Andrew Frowen Category: Security, Information Technology Word Count: 548 Keywords: computer forensics, computer forensic analysis, thumbnail, thumbs.db, thumbcache, xp, vista Author's Email Address: [email protected] Article Source: http://www.articlemarketer.com ------------------ ARTICLE START ------------------
When a person is suspected of possessing indecent images of children, investigators typically commission the services of a computer forensics analyst. Such an expert is then able to analyse the suspect's computer in order to recover evidence of wrongdoing. For computers running Windows XP, a common line of enquiry is to search for 'thumbs.db' files: hidden index files present in any directory containing images which have been viewed in 'thumbs mode'. The purpose of the thumbs.db file is to speed up the time it takes to display a folder in thumbs mode, providing an instant 96 x 96 pixel preview of image files such as JPEGs, BMPs, GIFs and PNGs, document image files such as TIFFs and PDFs, video files such as AVIs and MOVs, presentation files such as PPTs and some HTML web pages. Thumbs.db files are useful to computer forensic analysts as they retain thumbnails of images even after the main image is deleted, thus providing proof that the image was once present. However, thumbnails are stored differently within the Windows Vista operating system. Instead of a thumbnail file being created in every directory, all thumbnails are now stored in a set of 'thumbcache' files within a central directory: "AppDataLocalMicrosoftWindowsExplorer". One advantage of this system to computer forensic experts is that even if the entire directory containing an indecent image is deleted, the thumbnail may still be present in the central directory, albeit in a form that needs to be decoded using specialist software. However, this can also be a negative in that a user now has only to delete the thumbnail files in a single directory in order to remove all traces of otherwise deleted images throughout the hard drive. Vista thumbnails are now stored in a variety of sizes from 32 x 32 pixels up to 1024 x 1024 pixels, which are created according to the size at which the user views the thumbnail. This can present an advantage to computer forensic analysts in that it allows them to view more detail of the image than is available in Windows XP's 96 x 96 pixel thumbnails. Of course, it is also possible that the thumbnail images could have been viewed only at 32 x 32 pixels, which would make things harder for the analyst attempting to ascertain if the image was of an illegal nature. The new thumbnail system in Vista is also of significant benefit to analysts in cases where removable storage media has been attached to the computer, but is no longer present. For example, in Windows XP, if a USB hard drive was attached to a computer, and a set of images in a directory viewed in 'thumbs' mode, the thumbnails would be created and stored on the device, but in Vista, the thumbnails would be stored in the computer's 'Explorer' directory. This means that computer forensic analysts are now able to locate evidence of images that were viewed on, but never transferred from the removable media to the main computer. Of course, for the determined criminal, there are always new and increasingly complex ways to avoid detection, but at the time of writing, the location and analysis of thumbs.db and thumbcache files continues to represent an extremely effective method for the recovery of evidence relating to the possession of indecent images. IntaForensics a BS EN ISO 9001:2000 registered firm providing Computer Forensics, Expert Witness, Mobile Phone Forensics, and Forensic Data Recovery to the Legal Sector, Police Forces, Local Authorities and Commercial organisations internationally. Visit http://www.intaforensics.com. ------------------ ARTICLE END ------------------ [Non-text portions of this message have been removed]
