Pau Lo
asked on
image file opened in windows 7 from external USB attached device
If a user plugs into a windows 7 machine a smartphone or USB device via USB and views an image on the external device, apart from areas like lnk files and jump lists (and presumably certain registry entries) which will show a file name of the image opened, does windows create any sort of thumbnail on the PC's local drive of the image, or is the best you would ever get the date stamp and file name of the image opened, and not an actual thumbnail of the image itself. The filename in itself isn't of much use, but even a thumbnail of the image would be useful. I am just unsure where exactly on the drive that thumbnail may reside once opened.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Do you happen to know if the filenames are relevant or if any of the file attreibutes of each thumbnail each of the db files will give clues of the source of the full file?
e.g. they are all quite generic entries such as:
thumbcache_256.db
e.g. they are all quite generic entries such as:
thumbcache_256.db
They will all be generic unfortunately, the other place to check would be the temporary directory.
Your best option is to seize the phone if it's a work phone.
Regards,
Alex
Your best option is to seize the phone if it's a work phone.
Regards,
Alex
ASKER
which temporary directory are you referring to? C:\windows\temp?
No the one in Appdata\local\temp
ASKER
Just did some testing on my own windows 7 device, and specific to the thumb cache db files, the number suffix actually seems to represent the size of the thumbnails, as I had a db ending in ...1280.db and they open up almost full size. so I think the _32 and similar are essentially what we would think of thumbnails, whereas at some stage I must have messed around with the sizes and it actually captures almost a full screenshot of each. very interesting..
ASKER