Hi, I am trying to extract the cached images from the thumbs.db file, however it seems that the hex values for the images within thumbs.db are not standard. Am I missing a trick here or is there not an 'easy' way to extract the images from these files?
There is an easy way. From the specialist menu select refine volume snapshot. Then select search for pictures embedded ... This feature is not available for the professional version of WinHex.