01Location
- C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db
- C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
02Questions it answers
- Which picture thumbnails were generated for a user profile?
- Can a thumbnail be tied to an original file through its ThumbnailCacheId?
- At which sizes were thumbnails cached?
03Format and versions
| Format | Cache file: 24-byte header ('CMMM', format version, cache type, first entry offsets, entry count) followed by 'CMMM' entries with an entry hash, identifier string (hexadecimal ThumbnailCacheId), padding, data size, CRC-64 data and header checksums and the image data. Index file signature 'IMMM'. Little-endian. |
|---|---|
| Applies to | Format version 20 (Vista), 21 (7), 30 (8.0), 31 (8.1), 32 (Windows 10 and 11). The set of size-specific files differs per version (e.g. thumbcache_16 to thumbcache_2560, _sr, _wide, _exif, _custom_stream on Windows 10/11). |
04Key fields
| Field | What it tells you |
|---|---|
| File header | Signature, format version and cache type (which size file it is). |
| Entry hash | 8-byte value of unknown algorithm. |
| Identifier string | UTF-16 hexadecimal ThumbnailCacheId without leading zeros. |
| Data checksum / header checksum | CRC-64 values for integrity checks. |
| Data | The thumbnail image. |
05Examination workflow
- Collect all thumbcache_*.db files for each profile.
- Parse entries, validate checksums and export the image data.
- Where available, map ThumbnailCacheId values to files using the Windows Search database (windows.edb).
- Review recovered thumbnails together with ShellBags, LNK files and $MFT records for the same folders.
06Interpretation pitfalls
- There is no information in the thumbcache that links thumbnails to original files in all cases.
- The cited format documents no timestamps inside cache entries; timing must come from other artifacts.
- The header's entry count is not always accurate; parse entries sequentially.
08Sources
- Windows Explorer Thumbnail Cache database format libyal / libwtcdb (J. Metz) · checked 2026-10-14
- Windows thumbcache Forensics Wiki · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14