The file is not all that big, just kbs. Its not annoying - but a security risk.
Thumbs.db can be decoded to determine what pictures ou had on the disk.
^¼ÂÃH P I M 0 5 9 5 . J P G , 0 ª¶ÄÂÃH P I M 0 5 9 6 . J P G , 1 iæäÂÃH P I M 0 5 9 7 . J P G , 2 XòÂÃH P I M 0 5 9 8 . J P G , 3 R‹ÃÃH P I M 0 5 9 9 . J P G , 4 `²!ÃÃH P I M 0 6 0 0 . J P G , 5 ò°@ÃÃH P I M 0 6 0 1 . J P G , 6 Ó¦FÃÃH P I M 0 6 0 2 . J P G , 7 ÿNÃÃH P I M 0 6 0 3 . J P G , 8 &VÃÃH P I M 0 6 0 4 . J P G , 9 *M]ÃÃH P I M 0 6 0 5 . J P G , : àHºÃÃH P I M 0 6 0 6 . J P G , ; ’˜ÄÃH P I M 0 6 0 7 . J P G , < úŒ¡ÄÃH P I M 0 6 0 8 . J P G , = ÎóÄÃH P I M 0 6 0 9 . J P G , > <FÅÃH P I M 0 6 1 0 . J P G , ? e¯àÃH P I M 0 6 1 1 . A V I , @ 2ÃH P I M 0 6 1 2 . J P G , A îNÉðÃH P I M 0 6 1 3 . J P G , B ŸWâðÃH P I M 0 6 1 4 . J P G , C ‹¸ñÃH P I M 0 6 1 5 . J P G , D µ-ñÃH P I M 0 6 1 6 . J P G , E 6IEñÃH P I M 0 6 1 7 . J P G , F ìD¢ñÃH P I M 0 6 1 8 . J P G , G «tÂñÃH P I M 0 6 1 9 . J P G , H \}ÛñÃH P I M 0 6 2 0 . J P G , I Ïq òÃH P I M 0 6 2 1 . J P G , J 7û òÃH P I M 0 6 2 2 . J P G , K ¯âròÃH P I M 0 6 2 3 . J P G , L ??òÃH P I M 0 6 2 4 . J P G , M Ö›œòÃH P I M 0 6 2 5 . J P G , N öq&n ÃH P I M 0 6 2 6 . J P G , O ©õM¯5ÃH P I M 0 6 2 7 . J P G , P ©BsSÃH P I M 0 6 3 0 . J P G , Q ~HÊSÃH P I M 0 6 3 1 . J P G , R ŒoÑSÃH P I M 0 6 3 2 . J P G , S !*ÜSÃH P I M 0 6 3 3 . J P G , T =xêSÃH P I M 0 6 3 4 . J P G , U rXSÃH P I M 0 6 3 5 . J P G , V SN!SÃH P I M 0 6 3 6 . J P G , W &SÃH P I M 0 6 3 7 . J P G , X í§SÃH P I M 0 6 3 8 . J P G , Y BE'§SÃH P I M 0 6 3 9 . J P G , Z }?/§SÃH P I M 0 6 4 0 . J P G , [ å&9§SÃH P I M 0 6 4 1 . J P G , \ ž³¨SÃH P I M 0 6 4 2 . J P G , ] .Zu5]ÃH P I M 0 6 4 8 . J P G , ^ –ã~5]ÃH P I M 0 6 4 9 . J P G , _ Ñ;‡5]ÃH P I M 0 6 5 0 . J P G , ` ßbŽ5]ÃH P I M 0 6 5 1 . J P G , a 5ú®±ÂH P I M 0 6 5 2 . J P G , b "ƒ¯±ÂH P I M 0 6 5 3 . J P G , c ›‚õ´ÂH P I M 0 6 5 4 . J P G , d õ´ÂH P I M 0 6 5 5 . J P G , e äõ´ÂH P I M 0 6 5 6 . J P G
check out
http://www.accessdata.com/media/en_US/p ... .en_us.pdf
The early versions of thumbs.db files as they appeared in Windows ME and Windows 2000 contained
not only the thumbnail image of the parent file, but also the filename, drive letter, and path to that
image. Later versions, Windows XP and Windows 2003, store the image and its filename but not the
path.
An interesting aspect of thumbs.db files is that when a graphic is viewed and an entry made for it in the database, it is maintained indefinitely by the operating system. If the file is deleted, the image will
remain unless the thumbs.db file or the entire folder are deleted.
So just on the off hand chance you download porn with suspicious names like 10yrbj.jpg, 9yrdaddysux.jpg - you might delete the original photofile from your porn folder, but its still there! Forensic tools like FTK and Encase can view these thumbnail caches.
So, a suspect who has deleted evidence of photos prior to seizure of the computer, may still have thumbnail images of the graphics stored in the thumbs.db files. These graphics will remain, even if the folder is renamed or they may be located in unallocated space as deleted files.
So good idea, but for the wrong reason..
DNR
