ercompfor wrote:
I was wondering if anyone had any insight into the thumbcache_idx.db file in Windows 7. In Windows Vista, you could determine the last modified date/time. That appears to have changed in Windows 7. The 8 byte value for date/time was replaced with another 8 byte value, but I can't find any information as to what that value represents.Harry Parsonage epublished a paper (JFYI):
http://computerforensics.parsonage.co.uk/downloads/UnderMyThumbs.pdf
but that question (which is also there) is AFAIK still without an answer. <img src="images/smiles/icon_sad.gif" alt="Sad" title="Sad" />
According to this thesis by Sarah Morris:
https://dspace.lib.cranfield.ac.uk/bitstream/1826/8034/1/SLAMorris%20Final%20Thesis%20After%20Corrections.pdf
the field is just a sort of "unique" ID in Windows 7.
jaclaz
↧