-
Notifications
You must be signed in to change notification settings - Fork 290
Open
Labels
Description
Currently we have a generic OLEParser that handles Thumbs.db files. But we don't have any parser for thumbcache files, they are just sent to carving module to carve images, usually that returns partial images, since they are possibly fragmented into the thumbcache file.
Related project and documentation:
https://github.com/libyal/libwtcdb
https://github.com/libyal/libwtcdb/blob/main/documentation/Windows%20Explorer%20Thumbnail%20Cache%20database%20format.asciidoc
wladimirleite, hauck-jvsh and lfcnassif