Investigation and Automating Extraction of Thumbnails Produced by Image Viewers

Data carving is generally used to recover deleted images in digital investigations, but carving time can be significant and the deleted images may have been overwritten. Thus, thumbnails of (deleted) images are an alternative evidence, and can often be found within databases created by either operating systems or image viewers. Existing literature generally focus on the extraction of thumbnails from databases created by the operating system. Understanding thumbnails created by image reviewers is relatively understudied. Therefore, in this paper, we propose a new approach of automating extraction of thumbnails produced by image viewers. We then evaluate the utility of our approach using popular image viewers.