Pau Lo
asked on
images viewed from USB/smartphone
If a user plugs in a USB/smartphone into a windows 7 PC via USB cable, it basically brings up the device as an additional drive in windows, if they then open an image that is saved on their devices smartphone via the windows machine, although in the recent folders I can see they opened it, will there be a copy/thumbnail of the image viewed anywhere at all on the machine, and if so can you give any pointers on where to look. I did read about thumbs.db, but not sure they will be of use as the orginal device was unplugged from the machine.
Or... is the best you are ever going to get a list of filenames of images viewed which could be completely anonymous ai.e. IMG_12345.jpg and not give any clues on content.
Or... is the best you are ever going to get a list of filenames of images viewed which could be completely anonymous ai.e. IMG_12345.jpg and not give any clues on content.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I haven't used it in years, but I'm sure Scalpel will let you do it any way you like. Or if you don't want to manually run it from the command line, here's a little GUI interface:
https://code.google.com/p/carver-recovery/
https://code.google.com/p/carver-recovery/
in the past the vinetto can be useful thumb.db parser e.g. to extract thumbnail images and their metadata from those thumbs.db files generated under Microsoft Windows. but the thumbnail file is static meaning it is history trails captured when images are access or open via the windows explorer in specific folder, it does not track and follow if the image is shifted to other folder location etc. So if explorer see the images in the folder and is opened then the index file should be created (and can be parsed still). However, as shared it is just for those in that folder and do not track those image movement and transfer. To link the folder to mounted device it is probably back to looking at trails for the mounted drive letter storing those images and using tools (like USBDeview and USBLogView in www.nirsoft.net/utils/usb_log_view.html) to see USB devices history to map across the index content ...
Just to share that since Vista/Win7, this index file becomes a centralized database under user profile for explorer (which is what it is doing for as usual). However, I understand in Windows 7, thumbs.db files are not created under normal usage when a user browses a folder in explorer. However, they are created if the same folder is browsed through its network path such as via \\localhost\c$. In windows 8, there are the thumbcache and thumbs.db, the latter remains stored in User profile folder and now accessing other folders using their network paths such as \\localhost\c$ will create thumbs.db in other folders as well.
Just to share that since Vista/Win7, this index file becomes a centralized database under user profile for explorer (which is what it is doing for as usual). However, I understand in Windows 7, thumbs.db files are not created under normal usage when a user browses a folder in explorer. However, they are created if the same folder is browsed through its network path such as via \\localhost\c$. In windows 8, there are the thumbcache and thumbs.db, the latter remains stored in User profile folder and now accessing other folders using their network paths such as \\localhost\c$ will create thumbs.db in other folders as well.
ASKER