data leakage case #38, #39, Thumbcache
Forensic/CFReDS-Data Leakage Case2019. 1. 24. 07:45
https://www.cfreds.nist.gov/data_leakage_case/data-leakage-case.html
http://forensic-proof.com/archives/2092 "썸네일 포렌식 분석 (Thumbnail Forensics)"
#38. Where are ‘Thumbcache’ files located?
\Users\informant\AppData\Local\Microsoft\Windows\Explorer\thumbcache_[size].db
#39. Identify traces related to confidential files stored in Thumbcache. (Include ‘256’ only)
Thumbnail Database Viewer 를 통해 thumbcache_256.db 를 열면 다음과 같은 썸네일을 확인 할 수 있다.
[프로그램 다운로드 링크] http://www.itsamples.com/thumbnail-database-viewer.html
'Forensic > CFReDS-Data Leakage Case' 카테고리의 다른 글
| data leakage case #42~46, Windows Search Database, windows.edb (0) | 2019.01.24 |
|---|---|
| data leakage case #40, #41 sticky notes (0) | 2019.01.24 |
| data leakage case #37, print forensic (0) | 2019.01.24 |
| data leakage case #36, DOCX file searching (0) | 2019.01.24 |
| data leakage case#35, cd (opened files) (0) | 2019.01.24 |
