<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Disable Thumbnail Caching and Wipe Thumbs.db files on a Windows XP System</title>
	<atom:link href="http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/feed" rel="self" type="application/rss+xml" />
	<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system</link>
	<description>Rendering computer investigations irrelevant</description>
	<lastBuildDate>Wed, 01 Sep 2010 22:00:29 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
<xhtml:meta xmlns:xhtml="http://www.w3.org/1999/xhtml" name="robots" content="noindex" />
	<item>
		<title>By: Timy</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-188</link>
		<dc:creator>Timy</dc:creator>
		<pubDate>Sat, 13 Feb 2010 20:59:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-188</guid>
		<description>I also highly recommend Simple File Shredder.
It has a nice search feature, erase free space, DoD 7x and Guttmann 35x and adds a shred link in your right click context menu. Very simple, basic, and effective.

http://download.cnet.com/1770-20_4-0.html?query=Simple+File+Shredder&amp;searchtype=downloads</description>
		<content:encoded><![CDATA[<p>I also highly recommend Simple File Shredder.<br />
It has a nice search feature, erase free space, DoD 7x and Guttmann 35x and adds a shred link in your right click context menu. Very simple, basic, and effective.</p>
<p><a href="http://download.cnet.com/1770-20_4-0.html?query=Simple+File+Shredder&amp;searchtype=downloads">http://download.cnet.com/1770-20_4-0.html?query=Simple+File+Shredder&amp;searchtype=downloads</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jae B</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-173</link>
		<dc:creator>Jae B</dc:creator>
		<pubDate>Tue, 12 Jan 2010 06:47:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-173</guid>
		<description>ive done acouple things to DISABLE the thumb nail preview from being cached and they worked for a while. what i did was:
First, turn off thumbnail creation by opening Windows Explorer, clicking the Organize button and selecting Folder and Search Options.

Click on the View tab and check Always show icons, never thumbnails. Click the OK button.

Then, run Disk Cleanup on Drive C: and empty the cache so you can recover the disk space. You can find it in Accessories/System Tools.

In Windows Explorer, navigate to the AppData\Local\Microsoft\Windows folder under your name. (If you can&#039;t find it, just copy the following: %LocalAppData%\Microsoft\Windows
Paste it into the Address Bar and hit Enter.)

Right-Click on the Explorer folder and select Properties.

Select the Security tab.

Click the Advanced button.

On the Permissions tab, click the Edit button.

Uncheck &quot;Include inheritable permissions from this object&#039;s parent&quot;.

Click the Remove button in the Windows Security box that pops up.

Click the OK button on the Permissions tab.

Click the Yes button in the Windows Security box that pops up.

Close all the open boxes.

Go back into the Folder and Search Options and uncheck the Always show icons, never thumbnails and you&#039;re done.

Now, browse any folder you want and Windows will create the thumbnails on the fly, but won&#039;t save them to disk. I&#039;ve verified that these Security Settings will not be overwritten by rebooting Windows. However, I don&#039;t know if the Explorer directory is used for anything else. I&#039;ve been using Vista for over a year now and the only files in my Explorer directory were the thumbnail databases.

If you think you can do the same thing to the thumbnail database files instead of the Explorer directory, you can&#039;t. I tried that first and Windows was still able to delete them and create new ones. This is also true if you try setting the file&#039;s Read-only, Hidden and System attributes. 

as i said this worked for a while but not anymore for some reason. anyone know a way to keep the peview but disable the caching?</description>
		<content:encoded><![CDATA[<p>ive done acouple things to DISABLE the thumb nail preview from being cached and they worked for a while. what i did was:<br />
First, turn off thumbnail creation by opening Windows Explorer, clicking the Organize button and selecting Folder and Search Options.</p>
<p>Click on the View tab and check Always show icons, never thumbnails. Click the OK button.</p>
<p>Then, run Disk Cleanup on Drive C: and empty the cache so you can recover the disk space. You can find it in Accessories/System Tools.</p>
<p>In Windows Explorer, navigate to the AppData\Local\Microsoft\Windows folder under your name. (If you can&#8217;t find it, just copy the following: %LocalAppData%\Microsoft\Windows<br />
Paste it into the Address Bar and hit Enter.)</p>
<p>Right-Click on the Explorer folder and select Properties.</p>
<p>Select the Security tab.</p>
<p>Click the Advanced button.</p>
<p>On the Permissions tab, click the Edit button.</p>
<p>Uncheck &#8220;Include inheritable permissions from this object&#8217;s parent&#8221;.</p>
<p>Click the Remove button in the Windows Security box that pops up.</p>
<p>Click the OK button on the Permissions tab.</p>
<p>Click the Yes button in the Windows Security box that pops up.</p>
<p>Close all the open boxes.</p>
<p>Go back into the Folder and Search Options and uncheck the Always show icons, never thumbnails and you&#8217;re done.</p>
<p>Now, browse any folder you want and Windows will create the thumbnails on the fly, but won&#8217;t save them to disk. I&#8217;ve verified that these Security Settings will not be overwritten by rebooting Windows. However, I don&#8217;t know if the Explorer directory is used for anything else. I&#8217;ve been using Vista for over a year now and the only files in my Explorer directory were the thumbnail databases.</p>
<p>If you think you can do the same thing to the thumbnail database files instead of the Explorer directory, you can&#8217;t. I tried that first and Windows was still able to delete them and create new ones. This is also true if you try setting the file&#8217;s Read-only, Hidden and System attributes. </p>
<p>as i said this worked for a while but not anymore for some reason. anyone know a way to keep the peview but disable the caching?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Yar (Admin)</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-169</link>
		<dc:creator>Yar (Admin)</dc:creator>
		<pubDate>Wed, 30 Dec 2009 02:36:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-169</guid>
		<description>Yeah I would try loading the disk with a Linux boot CD and see if there is still a thumbs.db file in there. That&#039;s very interesting, I wish I could take a look at it personally. It&#039;s always possible that there is some other factor at play here like maybe other software or something. 

Keep me updated if you find something or email me directly if you want to talk more about it, through the contact form at the top.</description>
		<content:encoded><![CDATA[<p>Yeah I would try loading the disk with a Linux boot CD and see if there is still a thumbs.db file in there. That&#8217;s very interesting, I wish I could take a look at it personally. It&#8217;s always possible that there is some other factor at play here like maybe other software or something. </p>
<p>Keep me updated if you find something or email me directly if you want to talk more about it, through the contact form at the top.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: J W</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-167</link>
		<dc:creator>J W</dc:creator>
		<pubDate>Tue, 29 Dec 2009 03:36:37 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-167</guid>
		<description>Yes, It is Windows XP SP3. I understand from your explanation how the thumbs.db file works, and that it is in each folder that displays (thumbnail images of)picture content. I have enabled &quot;show system and hidden files,&quot; and also used the advanced search option to search hidden and system files. There are no longer any thumbs.db files to be found (I wiped them all) but my photo folder still shows a thumbnail image that I know was created before I disabled caching of thumbnail images, and wiped the thumbs.db files. I think I will try booting with a Linux live CD and see what I can find.
Either I am mistaken, or something a bit curious is going on.</description>
		<content:encoded><![CDATA[<p>Yes, It is Windows XP SP3. I understand from your explanation how the thumbs.db file works, and that it is in each folder that displays (thumbnail images of)picture content. I have enabled &#8220;show system and hidden files,&#8221; and also used the advanced search option to search hidden and system files. There are no longer any thumbs.db files to be found (I wiped them all) but my photo folder still shows a thumbnail image that I know was created before I disabled caching of thumbnail images, and wiped the thumbs.db files. I think I will try booting with a Linux live CD and see what I can find.<br />
Either I am mistaken, or something a bit curious is going on.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Yar (Admin)</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-166</link>
		<dc:creator>Yar (Admin)</dc:creator>
		<pubDate>Mon, 28 Dec 2009 04:47:25 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-166</guid>
		<description>Interesting JW. Is this on a Windows XP system? If it is Windows XP then the thumbnail will be in a thumbs.db file located within the folder containing the JPEG. Windows Vista and 7 store the thumbnail cache in a central folder named &quot;explorer&quot; under a profile/application data (appdata), etc.</description>
		<content:encoded><![CDATA[<p>Interesting JW. Is this on a Windows XP system? If it is Windows XP then the thumbnail will be in a thumbs.db file located within the folder containing the JPEG. Windows Vista and 7 store the thumbnail cache in a central folder named &#8220;explorer&#8221; under a profile/application data (appdata), etc.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: J W</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-165</link>
		<dc:creator>J W</dc:creator>
		<pubDate>Sun, 27 Dec 2009 04:46:30 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-165</guid>
		<description>I did all the steps. I disabled the caching, did a search (including system and hidden files) and wiped all thumbs.db files with Eraser (Tolvanin) 24 passes. Rebooted the computer for good measure. Then I imported a .jpg file into &quot;Photoshop&quot; altered it, and saved it back to the same file and folder. I opened the folder and the thumbnail was the same as it was before I wiped all the thumbs.db files. It was NOT a thumbnail of the altered photo, it was the original. If the cache had to be recreated from scratch, the thumbnail would have shown the alterations I made to the .jpg file. I clicked on the thumbnail, and when the file opened, it showed the changes I made in Photoshop, but the thumbnail never changed. I would say the original thumbnail never was erased. I loaded a forensic program, &quot;dmThumb&quot; and it found no thumbs.db files on my local drives. Where is the &quot;old&quot; thumbnail being stored?</description>
		<content:encoded><![CDATA[<p>I did all the steps. I disabled the caching, did a search (including system and hidden files) and wiped all thumbs.db files with Eraser (Tolvanin) 24 passes. Rebooted the computer for good measure. Then I imported a .jpg file into &#8220;Photoshop&#8221; altered it, and saved it back to the same file and folder. I opened the folder and the thumbnail was the same as it was before I wiped all the thumbs.db files. It was NOT a thumbnail of the altered photo, it was the original. If the cache had to be recreated from scratch, the thumbnail would have shown the alterations I made to the .jpg file. I clicked on the thumbnail, and when the file opened, it showed the changes I made in Photoshop, but the thumbnail never changed. I would say the original thumbnail never was erased. I loaded a forensic program, &#8220;dmThumb&#8221; and it found no thumbs.db files on my local drives. Where is the &#8220;old&#8221; thumbnail being stored?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tom</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-158</link>
		<dc:creator>Tom</dc:creator>
		<pubDate>Wed, 09 Dec 2009 14:15:27 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-158</guid>
		<description>Look here for a lcoal policy setting

http://www.technoleros.com/turn-off-caching-of-windows-7-thumbnails-in-hidden-thumbs-db-files/</description>
		<content:encoded><![CDATA[<p>Look here for a lcoal policy setting</p>
<p><a href="http://www.technoleros.com/turn-off-caching-of-windows-7-thumbnails-in-hidden-thumbs-db-files/">http://www.technoleros.com/turn-off-caching-of-windows-7-thumbnails-in-hidden-thumbs-db-files/</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: lastjuan</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-152</link>
		<dc:creator>lastjuan</dc:creator>
		<pubDate>Fri, 30 Oct 2009 12:02:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-152</guid>
		<description>Windows Vista has a similar type of .db file setup which I’ll throw in another article. I’ll include Windows 7 information as well, since it probably uses Vista’s method (not 100% sure on this though).

-----------------------

Windows 7 doesn&#039;t have the option anymore of disabling Thumbnail Cache on the options of Windows Explorer . Any idea of how could you disable it?</description>
		<content:encoded><![CDATA[<p>Windows Vista has a similar type of .db file setup which I’ll throw in another article. I’ll include Windows 7 information as well, since it probably uses Vista’s method (not 100% sure on this though).</p>
<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;</p>
<p>Windows 7 doesn&#8217;t have the option anymore of disabling Thumbnail Cache on the options of Windows Explorer . Any idea of how could you disable it?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-124</link>
		<dc:creator>Rob</dc:creator>
		<pubDate>Thu, 04 Jun 2009 12:16:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-124</guid>
		<description>I&#039;ve always wondered what that thumbs.db file was for... seems like another pointless Windows innovation to me!

&lt;a href=&quot;http://www.peopleperhour.com/find/Graphic_Designer&quot; rel=&quot;nofollow&quot;&gt;Freelance graphic designers&lt;/a&gt;</description>
		<content:encoded><![CDATA[<p>I&#8217;ve always wondered what that thumbs.db file was for&#8230; seems like another pointless Windows innovation to me!</p>
<p><a href="http://www.peopleperhour.com/find/Graphic_Designer">Freelance graphic designers</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: PC646</title>
		<link>http://www.anti-forensics.com/disable-thumbnail-caching-and-wipe-thumbsdb-files-on-a-windows-xp-system/comment-page-1#comment-105</link>
		<dc:creator>PC646</dc:creator>
		<pubDate>Wed, 29 Apr 2009 23:40:00 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=527#comment-105</guid>
		<description>I&#039;m a big fan of Eraser... Tested with FTK and Encase, no issues, always running and wiping.</description>
		<content:encoded><![CDATA[<p>I&#8217;m a big fan of Eraser&#8230; Tested with FTK and Encase, no issues, always running and wiping.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
