Pen Test Partners
Thumbnail forensics. DFIR techniques for analysing Windows Thumbcache | Pen Test Partners
TL;DR Introduction Windows thumbnail cache, or thumbcache, is a well-known forensic artifact, but often one that is overlooked. The thumbcache stores small previews of images, videos and documents and can persist even after the original files are deleted…