image file opened in windows 7 from external USB attached device

pma111
pma111 used Ask the Experts™
on
If a user plugs into a windows 7 machine a smartphone or USB device via USB and views an image on the external device, apart from areas like lnk files and jump lists (and presumably certain registry entries) which will show a file name of the image opened, does windows create any sort of thumbnail on the PC's local drive of the image, or is the best you would ever get the date stamp and file name of the image opened, and not an actual thumbnail of the image itself. The filename in itself isn't of much use, but even a thumbnail of the image would be useful. I am just unsure where exactly on the drive that thumbnail may reside once opened.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
A lack of information provides a lack of a decent solution.
Commented:
C:\Users\%username%\AppData\Local\Microsoft\Windows\Explorer

And use thumbcache viewer

https://www.raymond.cc/blog/download/did/527/

That may bring it over.

Author

Commented:
Thanks Alex, very useful.

Author

Commented:
Do you happen to know if the filenames are relevant or if any of the file attreibutes of each thumbnail each of the db files will give clues of the source of the full file?
e.g. they are all quite generic entries such as:

thumbcache_256.db
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

AlexA lack of information provides a lack of a decent solution.

Commented:
They will all be generic unfortunately, the other place to check would be the temporary directory.

Your best option is to seize the phone if it's a work phone.

Regards,

Alex

Author

Commented:
which temporary directory are you referring to? C:\windows\temp?
AlexA lack of information provides a lack of a decent solution.

Commented:
No the one in Appdata\local\temp

Author

Commented:
Just did some testing on my own windows 7 device, and specific to the thumb cache db files, the number suffix actually seems to represent the size of the thumbnails, as I had a db ending in ...1280.db and they open up almost full size. so I think the _32 and similar are essentially what we would think of thumbnails, whereas at some stage I must have messed around with the sizes and it actually captures almost a full screenshot of each. very interesting..

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial