The command-line version can be downloaded here: Thumbcache Viewer CMD Use -z to hide 0 byte entries when opening the database. You can also run the program from a command-line and supply the database file you wish to open or save.Įxample to open: thumbcache_viewer.exe thumbcache_32.dbĮxample to save thumbnails: thumbcache_viewer.exe -o Output thumbcache_32.dbĮxample to save a CSV (comma-separated values) file: thumbcache_viewer.exe -c example.csv thumbcache_32.db If you don't have a mouse wheel, you can hold the right mouse button down and click the left mouse button to zoom in, or hold the left mouse button down and click the right mouse button to zoom out. If you have a mouse wheel, you can scroll forward to zoom in, or scroll back to zoom out. To scale the image you can press the + or - keys to zoom in or out respectively. To center the image in the image window you can either press the Home key, or middle mouse button. By holding Shift and pressing an arrow key, the image will move 25 pixels. By holding Ctrl and pressing an arrow key, the image will move 5 pixels. Each arrow key will move the image 1 pixel in that direction. You can move the image around the window with the mouse or arrow keys. When an item is selected, an image window will pop up to preview the thumbnail. The three hash columns (Data Checksum, Header Checksum, and Cache Entry Hash) will change from lowercase, to uppercase. Likewise, the Cache Entry Offset column will change from bytes, to kilobytes. If you press Ctrl and click the Data Size column, for example, the entries will change from displaying in kilobytes, to simply bytes. Some of the column headers for the list can be clicked (while pressing Ctrl) and the entries below them will change. An edit box will display to rename the file. To rename a file in the list, click once on a selected list item. Mapped entries that included extended information while searching the Windows.edb will be displayed in green. Mapping files using Windows.edb (ESE database) should be done on an operating system that shares the same or newer operating system version in which the Windows.edb was generated. This ensures that the correct inputs can be hashed to compare against the entry hash in the database. Another thing to note is that mapping files by scanning directories must be done on the same computer system in which the database was generated. It's not that common to see unless the database has been overwritten or truncated. When verifying entries, mismatched checksums will be displayed in red along with the correct value. The main menu will allow you to save entries, export entries to a CSV (comma-separated values) file, remove entries from the list (the database is not modified), hide 0 byte entries, verify CRC-64 header and data checksums, and map files to entry hashes. Looking to open Thumbs.db files? Try my Thumbs Viewer instead. The program comes in two flavors: a graphical user interface and command-line interface. Thumbcache Viewer allows you to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files found on Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows 11. Thumbcache Viewer - Extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files.
0 Comments
Leave a Reply. |