From 7de1c42f67f63ee269c6d6d3ab507889c82f422a Mon Sep 17 00:00:00 2001
From: Joachim Metz <joachim.metz@gmail.com>
Date: Sat, 18 May 2024 07:21:49 +0200
Subject: [PATCH] Added definition for Windows thumbcache database

---
 artifacts/data/windows.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/artifacts/data/windows.yaml b/artifacts/data/windows.yaml
index 5509e258..cc839510 100644
--- a/artifacts/data/windows.yaml
+++ b/artifacts/data/windows.yaml
@@ -3053,6 +3053,16 @@ sources:
 supported_os: [Windows]
 urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
 ---
+name: WindowsThumbcacheDatabaseFiles
+doc: Windows thumbcache_*.db files.
+sources:
+- type: FILE
+  attributes:
+    paths: ['%%users.localappdata%%\Microsoft\Windows\Explorer\thumbcache_*.db']
+    separator: '\'
+supported_os: [Windows]
+urls: ['https://forensics.wiki/vista_thumbcache/']
+---
 name: WindowsTimezone
 aliases: [WinTimeZone]
 doc: The time zone of the system as a Windows time zone name or in MUI form.