Observed arrival · 2026-09-30
Thumbcache Parser turns Windows thumbnail caches into a forensic view
A browser-based tool for opening Windows thumbnail-cache files and inspecting cached images, including entries the page says were recovered from deleted data.
- For
- Forensic examiners and Windows artifact investigators
- Worth noticing
- Its collection instructions include a PowerShell shadow-copy workflow and KAPE and Velociraptor routes, not just file upload.
Field notes
Users can feed it individual cache files, a folder, or a ZIP; the page says folders and archives are scanned for cache files automatically. The collection section supplies concrete routes for a live Windows machine, KAPE, Velociraptor, and a disk-image workflow, including commands and expected output locations. A synthetic cache paired with a Windows Search index provides a practice case, and the page suggests using the time-range control to inspect activity around a selected thumbnail.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue