Investigation and Automating Extraction of Thumbnails Produced by Image viewers Wybren van der Meer Kim-Kwang Raymond Choo, Nhien-An Le-Khac, M-Tahar National Police of the Netherlands The University of Texas at San Kechadi Antonio School of Computer Science The Netherlands USA University College Dublin, wybren.van-der- [email protected] Belfield, Dublin 4, Ireland [email protected] {an.lekhac,tahar.kechadi}@ucd.ie Abstract— Today, in digital forensics, images normally called image meta-data) [4]. The image meta-data may contain provide important information within an investigation. However, thumbnails, dates, EXIF information and other sorts of not all images may still be available within a forensic digital information that are valuable forensic artefacts. The image investigation as they were all deleted for example. Data carving meta-data is saved inside databases [5] which reside on the can be used in this case to retrieve deleted images but the carving hard disk of the machine which has the image viewer installed time is normally significant and these images can be moreover on it. These databases can also contain meta-data information overwritten by other data. One of the solutions is to look at about images, which are no longer available. These images can thumbnails of images that are no longer available. These be deleted, or reside on other sources that are not available to thumbnails can often be found within databases created by either access at that time. For example, images are stored in an operating systems or image viewers. In literature, most research encrypted volume [6] which is not mounted. If the image and practical focus on the extraction of thumbnails from databases created by the operating system. There is a little resides on an encrypted volume, the image may not be research working on the thumbnails created by the image available for the investigator. Eventually, when the source reviewers as these thumbnails are application-driven in terms of image is not available, the databases of image meta-data from pre-defined sizes, adjustments and storage location. Eventually, image viewers are the only important sources of information thumbnail databases from image viewers are significant forensic available to investigators. artefacts for investigators as these programs deal with large The image meta-data we look at in this paper is the amounts of images. However, investigating these databases so far thumbnails. In the literature, most research and practical focus is still manual or semi-automatic task that leads to the huge amount of forensic time. Therefore, in this paper we propose a on the extraction of thumbnails from databases created by the new approach of automating extraction of thumbnails produced operating system. There is a little research working on the by image viewers. We also test our approach with popular image thumbnails created by the image reviewers due to many viewers in different storage structures and locations to show its challenges. The first challenge is the storage locations for the robustness. databases containing the thumbnails are differ for each image viewer [7] and there are moreover many image viewers in the Keywords—thumbnails; image acquisition; thumbnail market [8]. When a database containing thumbnails is located, forensics; automate process; another challenge is to extract available relevant information. These databases often have their own way of storing I. INTRODUCTION thumbnails. Consequently, traditional ways of extracting information could not be applied. An example of a traditional Internet has been a major and increasing concern for many ways of extracting information is carving for images [9]. years. Criminals are using numerous methods to access data in Carving tools take sector size of a hard disk into account [10]. the highly lucrative Cybercrime business. Organized crime, as When a carving tool finds an image, the tool often skips a well as individual users, are benefiting from the internet to certain amount of disk space. The skipping of a certain amount carry out illegal activity such as money laundering, drug of disk space is done because partitions on storage devices dealing and sharing child abusive material. The new connected have a dedicated minimal storage space for each file. Hence, way of life has drawbacks. One of them is that it has become the skipping of this minimal storage space of each file is done increasingly easier to acquire child abusive material (CAM) to make the carving process faster. Thumbnails within a [1]. After acquiring the CAM, crimes can look at these database can however, ignore these minimal storage spaces, as materials by using image viewers. Standard image viewers the database itself is one file. A carving program does not integrated in operating system do not offer effectively know there are multiple thumbnails within one file and organising and categorising of image collections. To automatically skips the minimal storage space, a space where effectively organize image collections, crimes normally turn to many other thumbnails may reside. specialised image viewers such as Xnview [2] and ACDsee [3]. Currently available literature suggests that investigating To effectively organise and categorise the images, the image databases is still a fairly unknown practice, as not a lot image viewers normally save information about the images (so- of information was found about investigating image databases. image can be tracked down [17]. The reverse searching can Most information found was tied to current carving methods, also be done with just the thumbnail. databases and thumbnails in general. Besides, large number of thumbnails stored in databases is also a challenges in terms of A paper has been written about a forensic analysis of the investigating time. Therefore, in this paper, we propose a Windows thumbcache files [18]. This paper deals with how new approach to locate and extract thumbnails from image thumbnails created by Windows are stored for different viewers. First, this approach is to locate the image databases by Windows versions. The versions Windows: 95, 98, ME, 2000, examining the image viewers and then to search for changes XP, 2003, Vista, 7 and 8 were analysed on how the thumbnails made on the hard drive. The changes gave clues about were the created by the operating system were stored. The paper image databases might be stored. When the image database is proceeds with investigating how the Windows thumbnails are found, we then extract the thumbnails inside by using different stored and how to extract them. A prototype tool for automated techniques described in this paper because of three different extraction of Windows thumbnails is presented. The prototype storage structures observed. Another contribution of this paper tool also takes information from the Windows index files, a is to automate the entire proposed process of investigation, feature which comparable tools seem to lack. The paper gives a using freely available tools and code to reduce the time needed good blueprint on how to design an automated tool for investigated thumbnails. It does however only focus on the for the forensic investigation. thumbnails created by the different Windows operating The rest of this paper is organized as follow: Section II systems. Thumbnails made by individual programs were not shows the related work of this research. We present the investigated. problem statement of investigating the thumbnails from image viewers in Section III. We describe our approach in Section IV. In [19], authors focus on when Windows thumbnails are We show our experiments on different image viewers analysis produced. In this paper different tests are conducted to see results found in Section V. Finally, we conclude and discuss on when and how Windows produces thumbnails. The paper future work in Section VI. concludes that sometimes thumbnails are even produced when the user does not browse related pictures. The investigator should always validate by other means if the user actually saw II. RELEATED WORK the pictures related to the found thumbnails. The actually In this section, a literature survey was conducted towards viewing of a picture is a parameter and has been taken into databases and carving. Subjects related to the investigation of account during the determining of the method to investigate image databases are also included. thumbnails generated by image viewers. To speed up the viewing of images the thumbnails has been Thumbnails produced by Android were also previously proposed for a while [11]. Today, the size of images and investigated [20]. In this paper authors focus on extracting photo’s is more and more bigger as image sensors become thumbnails and the file information of the original files from more advanced. Thumbnails are therefore still needed today to the main imgcache file found within an Android installation. speed things up, and to keep data usage low. This is also the The imgcache stores the thumbnails of images encountered by case on local residing storage within a computer. When a the operating system itself. According to the authors, the computer only has to load the smaller thumbnails, the user will filenames and other file information are also stored within this experience less waiting time. Fast storage like Solid State imgcache file. The authors were successful in extracting this Drives is becoming cheaper and more common. It is however information and finding out how the information was stored. still cheaper to store large quantities, like photo collections, on Also the EXIF information is stored within the found traditional hard drives. At the moment of writing, Solid State thumbnails. Conducted tests revealed that thumbnails remained Hard drives cost around €0.28 per GB [12], traditional hard in the imgcache file, even after the original files were deleted. drives cost around €0.028 per GB [13]. The reason why Solid In order to find this information, authors used tools like scalpel State Drives are faster than the traditional spinning hard drives [21] (carving tool), HxD [22] (Hex editor) and EXIF tool [23] is that the Solid State Drives have no moving parts [14].