Thumbnail forensics. DFIR techniques for analysing Windows Thumbcache

This report explains how Windows thumbnail cache (thumbcache) can be leveraged in forensic investigations to reveal deleted or hidden content and reconstruct user activity, including interpreting thumbnail sizes (e.g., 1280 vs. 96) to infer viewing behavior, locating and parsing cache files, and correlating with Shellbags, Prefetch, USN Journal, and event logs. A short insider-threat case study illustrates building a timeline that links folder access, file viewing, and deletions, showing how thumbcache combined with other artifacts can provide strong, corroborated evidence.