Practical Mobile Forensics - Fourth Edition

Thumbnails

Another source of important artifacts related to photos is the ithmb files. You can find these files at /CameraRollDomain/Media/PhotoData/Thumbnails. These files contain thumbnails not only for actual photos on the device but also for deleted ones. And, of course, there is a tool for parsing such files, iThmb Converter, which can be downloaded from http://www.ithmbconverter.com/en/download/ and is shown in the following screenshot:

Examining 3304.ithmb with iThmb Converter

As these files may contain thumbnails of deleted photos, they mustn't be overlooked by forensic examiners. What's more, some of them contain quite big thumbnails, ...