Windows Thumbnail Cache
| Format | Windows Thumbnail Cache |
|---|---|
| Short name | Thumbcache |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Explorer's thumbnail databases (thumbcache_*.db with an index file thumbcache_idx.db under %LOCALAPPDATA%\Microsoft\Windows\Explorer\, Windows Vista to Windows 11). Each entry holds a thumbnail image keyed by a cache ID but no file name; the original path can be recovered by matching the ThumbnailCacheId against the Windows Search index. Thumbnails can remain after the original pictures, videos or documents were deleted or were on a removable or network drive.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 43 4D 4D 4D | CMMM | Cache file signature 'CMMM' |
| offset 0 (0x0) | 49 4D 4D 4D | IMMM | Index file signature 'IMMM' |
Known extensions
.db
References
- Windows Explorer Thumbnail Cache database format (libyal/libwtcdb) https://github.com/libyal/libwtcdb/blob/main/documentation/Windows%20Explorer%20Thumbnail%20Cache%20database%20format.asciidoc
- ForensicsWiki — Windows thumbcache https://forensics.wiki/windows_thumbcache/
Cite this entry
Crush Format Reference, “Windows Thumbnail Cache”. https://kalink0.github.io/crush-forensics/formats/thumbcache/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction