images viewed from USB/smartphone

If a user plugs in a USB/smartphone into a windows 7 PC via USB cable, it basically brings up the device as an additional drive in windows, if they then open an image  that is saved on their devices smartphone via the windows machine, although in the recent folders I can see they opened it, will there be a copy/thumbnail of the image viewed anywhere at all on the machine, and if so can you give any pointers on where to look. I did read about thumbs.db, but not sure they will be of use as the orginal device was unplugged from the machine.

Or... is the best you are ever going to get a list of filenames of images viewed which could be completely anonymous ai.e. IMG_12345.jpg and not give any clues on content.
LVL 3
pma111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Robert ShermanOwnerCommented:
I believe that you are pretty much correct in that in most cases there will be nothing left behind but the record of the filename in your recent file history.  

One thing you might try is to look for files anywhere on the system's hard drives that were created around the same time that the files in question were accessed.   It's a long shot, but if the files were opened with an application that creates temp/cache copies of files, you might find something that way.
0
ChopOMaticCommented:
Thumbnails are unlikely, PMA, but not impossible. There's always a chance it got written to PAGEFILE or HIBERFIL or some other caching location. If you want to be certain, you could carve the entire image for the filetype you know it to be. Looking through carve results, especially when you're carving for images, can be a long process; after all, every modern computer is loaded up with images. For that reason, if you do carve, I'd start the review by looking at what got carved from PAGEFILE and HIBERFIL.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Author Commented:
will give that a go, any recommended free carving tools/apps, that you can specify a specific file i.e. pagefile?
0
ChopOMaticCommented:
I haven't used it in years, but I'm sure Scalpel will let you do it any way you like. Or if you don't want to manually run it from the command line, here's a little GUI interface:


https://code.google.com/p/carver-recovery/
0
btanExec ConsultantCommented:
in the past the vinetto can be useful thumb.db parser e.g. to extract thumbnail images and their metadata from those thumbs.db files generated under Microsoft Windows. but the thumbnail file is static meaning it is history trails captured when images are access or open via the windows explorer in specific folder, it does not track and follow if the image is shifted to other folder location etc. So if explorer see the images in the folder and is opened then the index file should be created (and can be parsed still). However, as shared it is just for those in that folder and do not track those image movement and transfer. To link the folder to mounted device it is probably back to looking at trails for the mounted drive letter storing those images and using tools (like USBDeview and USBLogView in www.nirsoft.net/utils/usb_log_view.html) to see USB devices history to map across the index content ...

Just to share that since Vista/Win7, this index file becomes a centralized database under user profile for explorer (which is what it is doing for as usual). However, I understand in Windows 7, thumbs.db files are not created under normal usage when a user browses a folder in explorer. However, they are created if the same folder is browsed through its network path such as via \\localhost\c$. In windows 8, there are the thumbcache and thumbs.db, the latter remains stored in User profile folder and now accessing other folders using their network paths such as \\localhost\c$ will create thumbs.db in other folders as well.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Digital Forensics

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.