Abstract

Since the introduction of Windows 95B, Microsoft users have been able to select a thumbnail view of any system folder. This option prompts the operating system to create a miniature preview of each file. By default, these generated images are archived to a local thumbnail database for quick system retrieval. Once an image is placed in the database, it will never be removed. By viewing the contents of thumbnail databases, a forensic investigator can easily examine the past and present media of a given system. Though this cache is not a perfect record, it is a good indicator of media storage locations and habits. For these reasons, we present ThumbScan, an automated search tool for locating and analyzing the archived thumbnails of modern Windows systems.

Library of Congress Subject Headings

Database searching--Computer programs; Search engines--Design; Cache memory; Microsoft Windows (Computer file); File organization (Computer science)

Publication Date

2010

Document Type

Thesis

Advisor

Pan, Yin

Advisor/Committee Member

Mishra, Sumita

Advisor/Committee Member

Stackpole, William

Comments

Note: imported from RIT’s Digital Media Library running on DSpace to RIT Scholar Works in December 2013.

Campus

RIT – Main Campus

Download

Share

COinS