Showing posts with label Thumbnails. Show all posts
Showing posts with label Thumbnails. Show all posts

Sunday, January 10, 2010

Windows 7 Forensics - Part IV - Thumbcache_*.db

Windows 7 creates small thumbnail images of graphic files the same way previous version of Windows does, nothing new here. It stores the thumbnails in the same location as in Windows Vista:

C:\Users\%username%\AppData\Local\Microsoft\Windows\Explorer

There are files named Thumbcache_32.db, Thumbcache_96.db, Thumbcache_256.db & Thumbcache_1024.db which correspond to the thumbnails stored for that specific user account and size.

Currently, the latest release of EnCase (6.15.0.82) does *not* parse these files correctly. The structure has slightly changed and therefore if you try and view the contents of any of the "thumbcache" files, EnCase will mount them without error, but they will appear empty. You can however, use the File Finder module to carve JPG images out of the *.db files.

If anyone is using any other tools and can confirm they handle these new Windows 7 thumbcache files correctly, please post the name in the comments so everyone can benefit and have a tool until EnCase incorporates this support.

Thursday, November 26, 2009

EnScript to create thumbnails of selected video files

This EnScript was designed to take all selected (blue checked) video files (avi, mp4, 3gp, etc.) in the case and to automatically create thumbnail pictures for each video. In order to do this, a program named “Video Thumbnails Maker” is required. This is a free program, but in order to use it in the method described below, you need to give a donation of $25.00 or more to the author of the program (I have no affiliation with the author, I use this program because its the only program that works from the command-line and works reliably, just make sure you have all the appropriate codecs loaded).

Once you give a donation, a reg key is sent via email that enables the program to be used from the command line (Platinum level). It is this feature that is required in order to integrate it with an EnScript. The program can be downloaded from http://www.suu-design.com and can be used for free via the GUI and you can manually convert videos using the GUI but you will not be able to use it as the described below until you register it and receive the activation code, which enables the command-line features.   

 

The “Video Thumbnails Maker” program supports many of the different video types, but I have found AVI to be the most reliable video type that seems to work 100% of the time.
 

To use this EnScript, simply select any video files you wish to make thumbnails of:
 

Then run the EnScript named “Make Thumbnails of selected video files”. The EnScript will create a root folder named “Video Thumbnails” in the default export folder specified in your case. Inside this folder, the EnScript will create a sub folder for each video file that you selected (The hash value is appended to avoid a collision of two files named the same but from different paths):


Inside each subfolder that is named after the video that was exported, the original video and all the thumbnail photos will be present. In addition, there will be a text file named “Video_Header.txt” that contains all the video metadata, name, path, hash, created date, written date. This information can be copied into an external report as the header information describing the video, then show all the thumbnails.


You can see that the thumbnails are all named after the original video, along with a timestamp of when in the video the thumbnail was created. In the example above, a thumbnail was created every second as that is what I have set in my EnCase.vtm file.  You can then quickly scan the images in Windows Explorer thumbnail view to see which picture contain valuable images and which you can delete. In the same folder is a text file with the video metadata that can be quickly inserted into an external report:





The “Video Thumbnail Maker” program  has many different options that you can set and then save those settings to a “preset” file. When you install the “Video Thumbnail Maker” program, there is a subfolder created under the program folder of “C:\Program Files\Video Thumbnails Maker” named “Presets”:
 

The five “Base_Presets_x.vtm” are installed when you install the program the first time. In order for the EnScript to work with this program, you must create a preset file named “EnCase.vtm” with the settings you want to use when creating the thumbnail pictures. Here is an example of my settings as I set them in the program GUI and then saved them to the “EnCase.vtm” preset:
 



This last option screen is where you can set the time sequence for your thumbnails. You can see above that I have the “Specific Time” option selected and the box below says “2 secs”, this means that regardless of how long the video is, this program will create a JPG thumbnail picture every two seconds until the end of the video.
At the top of this last screen you can see the “export” option. This is where you can set all the options you want to use with the program and the export them to a file named “EnCase.vtm” in the c:\Program Files\Video Thumbnail Maker\Preset\” folder. Whatever you save into that preset file are the options that the EnScript will use when creating your thumbnails. Some common mistakes:
1.   Make sure on the Environment screen, in the "output" section,  you do not select the “Save thumbnails to your folder” option. By default the program will place the thumbnails in the same folder where the video file is found, which is that subfolder that the EnScript automatically creates.
2.   When trying to create thumbnails of video files other than “AVI”, I have had to change the “Video Rendering” option on the Environment page between “Engine 1” and some of the other options. “AVI” seems to work great with “Engine 1”, but sometimes .3GP, MP4 and others fail with that option, so changing that option to “Engine 2” or “Extreme” usually fixes the failure.
Once you set all your options and save them to the EnCase.vmt file, you will not need to reconfigure the program unless you want to change some of the settings.
One valuable use for this EnScript is to export out any videos and then quickly scan the thumbnail images in Windows Explorer to see if it contains any images of interest. 



Computer Forensics, Malware Analysis & Digital Investigations

Random Articles