Tuesday, May 6, 2008

Vista Thumbnail Cache

I've been trying to breakdown the database structure of the new centralized thumbnail database files. Mainly, the "thumbcache_nnnn.db" and "thumbcache_idx.db" files. If anyone has any resources or can help, let me know.
There are a few programs that can display the contents, but I want to know were the data is coming from, how it works.
The databases have an identifier of "CMMM" and "IMMM", respectively.
I've found some great info from Ben Vanik's website/blog.
Hopefully this mystery will be solved, someday. :)

Saturday, May 3, 2008

Microsoft LE Tech Event

Just got back from Seattle, Washington. I was invited to speak at the Microsoft LE Tech conference. I did a 90 min presentation on computer forensics, specifically on the topic of forensics with the new Vista operating system.
There were some great presentations from various law enforcement people. And I met a lot of interesting people, including Mark Russinovich.
It was raining about 1/2 the time I was up there, and around the 100 degree mark back home. So I guess I went at a good time.
I also got to see the Mariners and Oakland face off at SafeCo field. It was a fantasic game and I had a decent seat at right field.
It started raining during the game, near the seventh inning if I remember correctly. After it started raining the stadium roof was deployed. It was a sight to see the entire roof move into position. Pretty impressive engineering, I must say.
All in all a good trip. I also discovered a new beer, Alaskan Amber, good Alt bier!