Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Thumbcache Parser

This script parses Windows Vista, Windows 7, Windows 8 and Windows 10 thumbcache_*.db files.

The script will process the files specified by the user and will bookmark any thumbcache records in those files provided they contain thumbnail data.

Note that thumbcache records that don't contain data won't be processed.

In addition to bookmarking the thumbnail data the script will optionally write that data into a logical evidence file that can then be brought back into the case.

Note that thumbcache files do not store the path of source images in the same way as thumbs.db files. Each thumbnail is identified by a thumbcache ID.

This ID most often takes the form of an 8-byte hash but Windows Vista may also generate IDs containing file-paths of one form or another.

As one would expect, the hash is one way so the path of the source image cannot be derived from the hash.

One way to map the hash to the source file is to query the Windows.edb search database. This stores the ID as the System.ThumbnailCacheId property of the source file. Note that this is unlikely to be successful for deleted files because the Windows.edb database is maintained in an up-to-date state.

The bookmark comment for each thumbcache record will include the thumbcache ID, offset, size and type (BMP, JPG or PNG) of the thumbnail data.

The logical evidence file produced by the script will store each thumbnail using the path to the source thumbcache file; the thumbnail itself will be given a name comprising the thumbcache ID and a file-extension matching the thumbnail type.

Note: Thumbcache IDs containing a path (usually only certain Vista thumbcache records have these) will have each backslash replaced with a center dot character (·) so as to prevent path-naming problems in the LEF.

Download Now

Version: 1.3
Tested with:
EnCase Forensic 7.10
Developer: Simon Key
Category: Artifact




WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key