Thumbs.db Viewer

  • Overview
  • Features
  • File Locator
  • File Carving

What is "Thumbs.db Viewer 3.6"

Our program was written to give the computer user tools to reconstruct Thumbs.db (thumbcache_*.db, iconcache_*.db, ehthumbs.db) database records.

The new release of Thumbs.db Viewer: version 3.6. This version represents a significant improvement. The program was completely rewritten, and is much more usable now.

Many new features have been added, including: full support for Windows 10 thumbcache and iconcache files (thumbcache_idx.db, thumbcache_16.db, thumbcache_32.db, thumbcache_48.db, thumbcache_96.db, thumbcache_256.db, thumbcache_768.db, thumbcache_1280.db, thumbcache_1920.db, thumbcache_2560.db, thumbcache_sr.db, thumbcache_wide.db, thumbcache_wide_alternate.db, thumbcache_exif.db, thumbcache_custom_stream.db, iconcache_idx.db, iconcache_16.db, iconcache_32.db, iconcache_48.db, iconcache_96.db, iconcache_256.db, iconcache_768.db, iconcache_1280.db, iconcache_1920.db, iconcache_2560.db, iconcache_sr.db, iconcache_wide.db, iconcache_wide_alternate.db, iconcache_exif.db, iconcache_custom_stream.db); thumbnails gallery (up to 15 pictures per page); at first start the program automatically displays the content of the found thumbcache file; new navigation (usable Track Bar); disassembled and displaying headers of thumbcache files; disassembled and displaying headers of entries for thumbcache_idx.db; disassembled and displaying headers of thumbnails; displaying image details, etc.; uninstall program; supports file extension-based associations (if they have not been previously defined); toggle the display hidden system files and folders on and off via main menu; manual file in pdf format; english, german, russian and french interface; "More Details" button for Windows Vista, Windows 7, Windows 8 and Windows 10 thumbcache files; work of the "Extract/Open Selected File" buttons and "Extract/Open Selected File" main menu (context menu) items are differs now.

Our program allows to reconstruct Windows' thumbnails stored into: thumbs.db; ehthumbs.db (Windows XP Media Center Edition); thumbcache_idx.db, thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, thumbcache_1024.db, thumbcache_sr.db (Windows Windows Vista, Windows 7); thumbcache_idx.db, thumbcache_16.db, thumbcache_32.db, thumbcache_48.db, thumbcache_96.db, thumbcache_256.db, thumbcache_1024.db, thumbcache_sr.db, thumbcache_wide.db, thumbcache_exif.db (Windows 8); iconcache_idx.db, iconcache_16.db, iconcache_32.db, iconcache_48.db, iconcache_96.db, iconcache_256.db, iconcache_1024.db, iconcache_sr.db, iconcache_wide.db, iconcache_exif.db (Windows 8); thumbcache_768.db, thumbcache_1280.db, thumbcache_1920.db, thumbcache_2560.db, thumbcache_wide_alternate.db, thumbcache_custom_stream.db (Windows 10); iconcache_768.db, iconcache_1280.db, iconcache_1920.db, iconcache_2560.db, iconcache_wide_alternate.db, iconcache_custom_stream.db (Windows 10).

From Windows Vista Thumbs.db file has been replaced by a number of "thumbcache_*.db" (thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, thumbcache_1024.db, thumbcache_sr.db, thumbcache_idx.db) files which are now located within a user's profile

From Windows 8 were added: thumbcache_16.db, thumbcache_48.db, thumbcache_wide.db, thumbcache_exif.db, iconcache_16.db, iconcache_32.db, iconcache_48.db, iconcache_96.db, iconcache_256.db, iconcache_1024.db, iconcache_sr.db, iconcache_wide.db, iconcache_exif.db, iconcache_idx.db

From Windows 10 were added: thumbcache_768.db, thumbcache_1280.db, thumbcache_1920.db, thumbcache_2560.db, thumbcache_wide_alternate.db, thumbcache_custom_stream.db, iconcache_768.db, iconcache_1280.db, iconcache_1920.db, iconcache_2560.db, iconcache_wide_alternate.db, iconcache_custom_stream.db and deleted: thumbcache_1024.db, iconcache_1024.db

The Microsoft Windows operating system has the ability to generate thumbnail views of files and display them to the user.

A thumbnail view is commonly known to be a miniature picture that represents a larger graphic.

Operating system create hidden system files aren't visible to the common user. This system file is called a Thumbs.db and is actually a database of the miniature images that exist in the folder from which they were initiated. Thumbs.db (thumbcache_xxx.db) files will contain an image of every graphic in the folder if the user viewed them as thumbnails. Each time files are added to the folder, new records and miniature graphics will be created in the Thumbs.db (thumbcache_xxx.db). An interesting aspect of Thumbs.db (thumbcache_xxx.db) files is that when a graphic is viewed and an entry made for it in the database, it is maintained indefinitely by the operating system. If the file is deleted, the image will remain unless the graphic file or the entire folder are deleted.

The early versions of Thumbs.db files as they appeared in Windows ME and Windows 2000 contained not only the thumbnail image of the parent file, but also the filename, drive letter, and path to that image. Later versions, Windows XP and Windows 2003, store the image and its filename but not the path. See Table below for variations in these operating systems.

Thumbs.db Variations

 

Windows

 

ME

2000 (FAT)

XP

2003

Vista/ 7/ 8/ 10

Drive

Yes

Yes

No

No

No

File name

Yes

Yes

Yes

Yes

Reference

Path

Yes

Yes

No

No

No

In Windows Vista / Windows 7 / Windows 8 Thumbs.db file has been replaced by a number of "thumbcache_xxx.db" files which are now located within a user's profile at
\Users \<username> \AppData \Local \Microsoft \Windows \Explorer

If you don't see the thumbs.db file on your system, first make sure you have show hidden files and folders selected in your Windows Explorer Options Tab. Go to Windows Explorer, select "Tools | Folder Options", select the View tab and check the "Show hidden files and folders" option as well as unselecting "Hide extensions for known file types" and unselecting "Hide protected operating system files". If you still don't see it, you may have a Windows 2000 operating system working on an NTFS drive in which case you will not have a thumbs.db but rather Alternate Data Streams handling the thumbnails.

The "File" item in the main menu has two options for showing hidden system files: Show hidden files and folders Do not show hidden files and folders

Thumbs.db Viewer 3.6 allows: displaying Thumbs.db, thumbcache_*.db, iconcache_*.db database records as well as the miniature graphics generated in each (with the original file name and timestamp); displaying technical information (headers of files, entries and thumbnails, image details, etc.); collects all the Thumbs.db, thumbcache_*.db, iconcache_*.db files in and below the specified folder; searches the Recycle Bin (INFO2 files) for deleted Thumbs.db, thumbcache_*.db, iconcache_*.db files; extracts and views all or selected pictures as an HTML representation; views with an external image viewer any of the original files corresponding to those stored in the Thumbs.db (thumbcache_*.db, iconcache_*.db) thumbnail metadata (if it exists); views the image in full size or as the best fit for the program`s window; rotates images right or left by 90 degrees; using a heuristic algorithm, the program can search swap and hibernation files for JPG graphic files.

The Program Window

Thumbs.db is a hidden system file generated automatically by Windows when you view the contents of a folder in "Thumbnail" or "Filmstrip" view. Thumbs.db contains a copy of each of the tiny preview images generated for image files in that folder so that they load up quickly the next time you browse that folder.

From Windows Vista Thumbs.db file has been replaced by a number of "thumbcache_*.db" files which are now located within a user's profile thumbcache_32.db - stores thumbnails up to 32x32 pixels; thumbcache_96.db - stores any thumbnails larger than 32x32 pixels with maximum dimensions of 96x96 pixels; thumbcache_256.db - stores any thumbnails larger than 96x96 pixels with maximum dimensions of 256x256 pixels. Some entries may not contain image data; thumbcache_1024.db - stores any thumbnails larger than 256x256 pixels with maximum dimensions of 1024x1024 pixels.

Thumbcache_idx.db contain index of other thumbcache_*.db files. In practice some files may contain more items than found in Thumbcache_idx.db

From Windows 8 were added: thumbcache_16.db, thumbcache_48.db, thumbcache_wide.db, thumbcache_exif.db, iconcache_16.db, iconcache_32.db, iconcache_48.db, iconcache_96.db, iconcache_256.db, iconcache_1024.db, iconcache_sr.db, iconcache_wide.db, iconcache_exif.db, iconcache_idx.db

From Windows 10 were added: thumbcache_768.db, thumbcache_1280.db, thumbcache_1920.db, thumbcache_2560.db, thumbcache_wide_alternate.db, thumbcache_custom_stream.db, iconcache_768.db, iconcache_1280.db, iconcache_1920.db, iconcache_2560.db, iconcache_wide_alternate.db, iconcache_custom_stream.db and deleted: thumbcache_1024.db, iconcache_1024.db

Deleting the Thumbs.db file in Windows has no affect on your operating system (despite the message you will see stating that it is a system file) or the future ability to view thumbnails at any time: the Thumbs.db file is recreated in each folder each time you view thumbnails.

Even though the images have been deleted in the folder they could still exist in the Thumbs.db file along with their modification dates.

Remember that Thumbs.db files are system files and therefore hidden unless you use the "Tools | Folder Options" command to make them visible. You also have to deselect "Do not cache thumbnails" option to make sure that Windows generates the Thumbs.db file in that directory.

After program's start its window is shown on your monitor:

The Thumbs.db Viewer 3.6 window includes standard Windows components. Of particular interest: the Main Menu and Toolbar provides quick ways of performing the most common tasks: the Main Window Area displays information about the Thumbs.db files, the progress of the program actions, details of the cache and details of the thumbnail and original image: the Status Line displays the processing time of the currently selected Thumbs.db, the number of thumbnails and current image dimensions.

Opening Thumbs.db / thumbcache_*.db

Use the Open toolbar button or select "File | Open" from the program "File" pull-down menu

to activate the standard Open dialog box:

The information from Thumbs.db (thumbcache_*.db, iconcache_*.db) file will be loaded into the following table:

The File Details panel displays information about the Thumbs.db (thumbcache_*.db, iconcache_*.db) file:

The button in the right top corner of the list view panel allows minimizing the panel and emptying the space for thumbnails gallery:

Table

Once an existing Thumbs.db (thumbcache_*.db, iconcache_*.db) is open you can extract or work with the thumbnails in the database. The files in an Thumbs.db (thumbcache_*.db, iconcache_*.db) are listed in a table in the main program window.

You can look at all the file names, with details, stored in the Thumbs.db (thumbcache_*.db, iconcache_*.db), using the scroll bar, arrow keys or usual Windows commands.

You can quickly sort the main window by clicking once on the header of a column (e.g. click on "Original Name" in the header above the list of files to sort the list by filename). Any table may be sorted by columns in descending or ascending order.

The table context menu provides quick access to useful commands. To display the table context menu, right-click anywhere on the table.

Viewing Files

When you select the file from the list its thumbnail is shown in the "Image View" Tab.

A splitter helps you to divide a program window into resizable panes.

The "Image View" Tab has the toolbar with different buttons. These buttons correspond to different commands:

These buttons are described below:

Table

Button Button Name Description
Rotate clockwise Rotate the image by 90o clockwise (this turn will be stored if you show the files later). Turn the picture few times to get desired view. For example turn the picture twice to turn it upside-down.
Rotate counter-clockwise Rotate the image by 90o counter-clockwise (this turn will be stored if you show the files later). Turn the picture few times to get desired view.
Best fit Reduce or enlarge the image to fit into the window's current size.
Actual Size Display the image without scaling.

You can easily view (with external image viewer) any of the files stored in a Thumbs.db (thumbcache_*.db, iconcache_*.db) by double clicking on the file in the main program window (or by selecting "Open selected file" from the "Actions" pull-down menu or table's or thumbnail's (from small gallery) context menu).

The program will open the image with the associated application

Or, you can view a file with the default viewer or a viewer of your choice by selecting "Open selected file with..." from the "Actions" pull-down menu or table's or thumbnail's (from small gallery) context menu:

You can view with external image viewer any of the original file corresponding to stored in an Thumbs.db (thumbcache_*.db, iconcache_*.db) thumbnail's metadata (if it exists in the appropriate folder) after pressing "alive" "Original File View" button or by selecting apropriate item from the table's context menu.

The Thumbnail Details panel displays technical information (headers of entries and image info) :

The button in the right top corner of "Thumbnail Details" panel allows minimizing the panel and empting the space for image view

Extracting Files

When you extract a file, the program places it in the folder of your choice.

Select "Extract Checked Files" from the Actions menu (or table's context menu) or select "Extract Selected File" from the Actions menu (or table's context menu) to display the Extract dialog box. Use the Extract dialog box to extract files from the open Thumbs.db (thumbcache_*.db, iconcache_*.db) to your disk.

The "Extract Selected File" command instructs the program to extract only file that are selected in the table The "Extract Checked Files" command instructs the program to extract only files that are checked in the table

The program extracts files from the Thumbs.db (thumbcache_*.db, iconcache_*.db) to the folder specified in the Directory Name field. You can specify this folder in one of following ways: Select a folder and drive in the Directories panel. Type a folder name in the Directory Name field. Type the name of the new folder in the Directory Name field (activates the Confirm dialog box).

Some of the metadata of the picture (and the links to the existing original files) are presented in an HTML report generated by the program.

Use the Confirm dialog box to run the thumbnails extracting report.

Please click on the blue boxed thumbnail to see the original image

Finally, the Confirm dialog-box will be shown:

You can Open Destination Folder by pressing the Yes button. A Windows Explorer window is opened:

The window will show the folder from which the files were extracted.

The "Extract Selected File" command instructs the program to extract only files that are selected in the table. This action consists of four steps.

Step 1

Step 2

Step 3

Step 4

Overview

Use the "File Locator" toolbar button or select "File | File Locator" from the program "File" pull-down menu

to activate the standard "Browse for Folder" dialog box:

The program will then collect all the Thumbs.db (ehthumbs.db, thumbcache_*.db, iconcache_*.db) files in and below the specified folder (Root Directory) and present them in a table:

You can easily display the full content of the any file shown by double clicking on the row in the table (or by selecting "Thumbs.db Show" from the Actions pull-down menu or after pressing the "Thumbs.db Show" toolbar button).

Drag and drop operations are also supported.

A splitter helps you to divide a program window into resizable panes.

Contrary to popular belief, when a file is deleted from a computer it is not really deleted. This is especially true for Microsoft Windows Operating Systems. Windows utilizes a repository for deleted files called the Recycle Bin. The existence of the Recycle Bin allows a user to retrieve a document he accidentally deleted.

The program searches the Recycle Bin (INFO2 files) for deleted Thumbs.db files:

Shredding files

It is a non-trivial task to remove the files from your computer reliably and without the possibility for restoring them. Moving the files to the Recycle Bin creates an illusion of data destruction. Simply by writing over the old files also does not destroy the old information reliably. The hard drive writing head positioning inaccuracy does not permit removing residual magnetization on the side of each track.

This program uses a special method of overwriting files with different byte combinations. This technology conforms to the norm of the Peter Gutman method, which makes software and hardware file recovery impossible.

File Carving

When a computer's RAM is full and the operating system must allocate memory for an application, the operating system makes room in RAM by writing out part of its contents to a temporary scratchpad called a 'swap file.' A swap file is simply dedicated space on a hard drive whose contents are temporary and overwritten as needed. Under Windows operating systems, swap files are usually located in the root directory. These files are named pagefile.sys (hiberfil.sys, swapfile.sys) in the most current versions of Windows operating systems and win386.swp in older versions of Windows (3/3.1, 95, 98, and ME). The swap file is essentially a scratchpad to temporarily hold data, and its contents are overwritten frequently. Hibernation files are usually found on laptop computers, as opposed to on workstations or servers. The hibernation file holds the contents of RAM when the laptop is placed in hibernation mode. When a laptop is put into hibernation mode, the operating system writes out the contents of RAM to the hard drive and then puts the computer into a suspended state. When the laptop is 'awakened,' the previous contents of RAM are transferred back into RAM from the hibernation file, thus restoring the state of the computer.

Use the File Carving toolbar button or select "File | File Carving" from the program "File" pull-down menu

to activate the standard Open dialog box:

The swap and hibernation files are locked while the operating system is running and therefore cannot be easily accessed under a live system.

If the errors took place the information window is shown:

The File Details panel allows getting more information about the errors:

The safest way to access these files is by powering off the computer and rebooting using a boot disk and copying the appropriate file to newly created folder.

Using a heuristic algorithm, the program can search swap and hibernation files for JPG graphic files (as seen in the pictures below).

If you see a white image - try viewing with an external image viewer.

Since the program uses a heuristic algorithm, some files may have the wrong format, and thus can not be viewed

The File Details panel displays information about the selected file:

You can extract and view all or some of the selected thumbnails as an HTML representation:

Flag Counter