Added definition for Windows thumbcache database

joachimmetz · May 18, 2024 · 7de1c42 · 7de1c42
1 parent 4ea1e76
commit 7de1c42
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/artifacts/data/windows.yaml b/artifacts/data/windows.yaml
@@ -3053,6 +3053,16 @@ sources:
 supported_os: [Windows]
 urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
 ---
+name: WindowsThumbcacheDatabaseFiles
+doc: Windows thumbcache_*.db files.
+sources:
+- type: FILE
+  attributes:
+    paths: ['%%users.localappdata%%\Microsoft\Windows\Explorer\thumbcache_*.db']
+    separator: '\'
+supported_os: [Windows]
+urls: ['https://forensics.wiki/vista_thumbcache/']
+---
 name: WindowsTimezone
 aliases: [WinTimeZone]
 doc: The time zone of the system as a Windows time zone name or in MUI form.