ThumbnailExpert
ThumbnailExpert is a unique program for forensic examination of thumbnail cache files created by different multimedia applications. They may include image viewers, video editors, file managers, software for mobile phones and many other applications. All these programs are similar in one – they all create files that store intermediate results of their work which may be interesting for forensic experts as digital evidence.
ThumbnailExpert makes it easy to find, view, analyze and create reports on the content of thumbnail databases generated by many applications. The user is not required to have any knowledge of the internal structure of these files and their location because the program is able to find, decode and display these files on its own. You only need to select a disk or disks to run a search, and the rest of the job is done hands down.
ThumbnailExpert has been developed in close collaboration with end-users and optimized primarily to the needs of forensic experts whose ideas and feedback are reflected in the feature set and simple, intuitive interface designed in the Windows Explorer-style. Thanks to this the user can perform tasks with remarkable ease.
The unique feature of the program is a great number of decoded formats. Currently there are over 70 supported formats, and their number is constantly growing thanks to the continuous efforts of the development team. The authors keep track of new software releases, new versions of existing applications and study the mechanisms they employ to cache information. If a new format appears or an old one is modified, ThumbnailExpert is updated instantly to address this change. Thus, for example, ThumbnailExpert was one of the first programs to introduce support for processing a new thumbnail cache format of Microsoft Windows 7.
As an additional feature, ThumbnailExpert lets users view images contained in intermediate files. The program supports the most common graphic formats, such as BMP, GIF, PNG and JPEG. If a picture contains metadata, such as segments of JPEG files (EXIF, IPTC, etc.), this data is also displayed. Unique to this ability is that the program relies on signature analysis of file content, rather than file extension to determine the presence of an image in a file. This makes it possible to find all images in a file, rather than just the first one which is typical of many similar utilities.
ThumbnailExpert can be used not only in criminal investigation, but may also serve as a tool to recover lost data. In most cases, thumbnail cache contains miniature copies of existing graphic files, but sometimes thumbnail images may have the same size as their originals. For example, Nokia PC Suite software saves original graphic files from the cell phone memory to its thumbnail database, PCCSFile.db. Standard Windows Vista and Windows 7 databases contain thumbnail images with a size up to 1024x1024 pixels. So, in case original files are lost, ThumbnailExpert can be used to restore pictures from thumbnail cache in fairly high quality.
ThumbnailExpert uses low-level reading of file formats which allows an expert to examine files without any modifications. Moreover, the program, unlike similar applications, is able to decode partially even broken files that were restored after deletion using other tools. In case a thumbnail database consists of multiple files, the program can decode even separate files if the rest of the files are unrecoverable.
Key features
- Decode thumbnail databases of over 70 applications
The program offers full support for thumbnail databases of many programs, and the number of supported formats keeps on growing constantly. It is possible to decode separate files from a thumbnail database.
- View standard graphic files
The program allows the user to view standard graphic files in BMP, GIF, PNG and JPEG. It is also possible to run a search for images in these formats within any file.
- View metadata of graphic files
The program can show the content of EXIF segments of JPEG files, including thumbnails they contain.
- Portable
The user can run program from any device, including a removable one. The program is portable and does not require any frameworks or special libraries to do its job.
- Easy file search
Find any file in a snap. The user does not need to search for files manually. The program can handle the search job automatically, saving the user time and efforts.
- Save search results
The list of found files can be saved for future reference. Saved results let the user quickly open the files that have been found earlier without having to run a search again.
- Reports
The program creates detailed reports on content of found files in HTML.
- Export
The program lets the user save to a data storage device any information, such as found image thumbnails, as well as metadata associated with thumbnails.
- Tabbed interface
The user can open additional tabs, which makes it easier and more convenient to analyze data.
- Markers
With markers, the user can easily mark important information and get back to it later.
- Support for external applications
The user can open found images in external applications associated with graphic files to edit images further – make them bigger, correct color and perform other operations.
- Clipboard
The program allows the user to copy to clipboard any information, such as names of found files, found image thumbnails, metadata associated with thumbnails. Copied data can be pasted to other documents.
FAQ
Q) I bought the program and got the license key. What do I need to do with the key to activate the program?
A) Copy and paste the file of the key to the directory that contains the executable file. Once launched, the program detects the key and removes the limitation of the demo mode. Attention! If the key is deleted from the directory, the program downgrades to the demo mode automatically.
Q) I renamed the program from ThumbExpert.exe to Expert.exe, and now it won’t detect the key.
A) Rename the key file from ThumbExpert.xkey to Expert.xkey.
Q) I want to save the program to CD. How do I do it properly?
A) When you record the program to CD, it is important that the folder should contain the executable file, program key and an empty file with the name of the executable file and extension .config. The latter is necessary to disable the appearance of the License Agreement on program launch.
Q) The program won’t open or find thumbnail cache files, though it claims to decode them. I know for sure I have thumbnail cache files on my hard disk.
A) This may happen because you do not have access rights to these files due to specific security policies of your operating system. For example, it often occurs in Windows Vista and Windows Seven. Try running the program with administrator rights.
Q) It takes too long to open some files with the program. What’s the reason for it?
A) To decode files, the program uses algorithms that search for deleted data, letting users find data within files, even if there are no links to them in the index file. Though it takes long to process data, the algorithm allows extracting maximum information from a file.
If you want to buy ThumbnailExpert, send message to me.