or Filmstrip view in Windows Explorer) will have a Thumbs.db file. Folders with pictures also display previews on their icon when displayed in Thumbnail mode – the first four images in the folder at 40×40 pixels (or proportionally shaped), with a 1-pixel divider overlaid on a standard large folder icon. The Thumbs.db file is stored in Compound File Binary Format format, the same format that many Microsoft Office products use. Centralized thumbnail cache Beginning with Windows Vista, thumbnail previews are stored in a centralized location on the system. This provides the system with access to images independent of their location, and addresses issues with the locality of Thumbs.db files. The cache is stored at %userprofile%\AppData\Local\Microsoft\Windows\Explorer as a number of files with the label thumbcache_xxx.db (numbered by size); as well as an index used to find thumbnails in each sized database. However, when browsing network shares with write permission, Windows Vista and Windows 7 store a Thumbs.db file in the remote directory instead of using the (local) central thumbnail cache. This can cause issues when deleting remote shares, as the directory will become locked for a period of time when selected as Windows Explorer automatically creates a remote Thumbs.db file. Creating Thumbs.db files on remote shares can be disabled with a Group Policy setting. As forensic evidence Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive. For example, the FBI used the "thumbs.db" file in 2008 as evidence of viewing depictions of child pornography. In 2013, research was conducted that focused on the Digital Forensic implications of thumbnail caches and recovering partial thumbnail cache files. It identified that whilst there is a standard definition of a thumbnail cache the structure and forensic artifacts recoverable from them varies significantly between operating systems. The work also showed that the thumbcache_256.db contains non-standard thumbnail cache records which can store interesting data such as network place names and allocated drive letters. See also .DS_Store Quick Look References External links Thumbcache Viewer – open-source thumbcache_*.db viewer Thumbs Viewer – Source to view Thumnail Vinetto is a forensics tool to examine Thumbs.db files. – Description of thumbs.db file Prevent the creation of thumbs.db files via Group Policy (Windows 7) Windows files