Forensicsforensicsthumbnailsthumbs.dbmetadatawindows

Vinetto

Vinetto is a forensics tool to examine Thumbs.db files by extracting thumbnail pictures and their metadata generated under Microsoft Windows. It helps *nix-based investigators preview thumbnails of deleted pictures and obtain information like dates and paths about them.

Description

Vinetto is a console program designed for forensics analysis of Thumbs.db files, which are created by Microsoft Windows to store thumbnails. It extracts thumbnail pictures along with associated metadata, enabling investigators to recover visual previews and details of potentially deleted images.

Use cases include easily previewing thumbnails of deleted pictures on Windows systems during *nix-based forensics investigations. It provides critical information such as dates, paths, and other metadata about deleted pictures, aiding in evidence recovery.

The tool supports various operating modes and options for detailed examination, including HTML report generation and EDB file analysis for original thumbnail filenames.

How It Works

Vinetto parses Thumbs.db files or similar thumbnail databases, extracting embedded thumbnail images and metadata. It operates in modes like file, directory, recursive, or automatic processing of input files or directories. Additional support for Extensible Storage Engine Database (EDB) files allows recovery of original thumbnail filenames, with options for MD5 hashing, quiet mode, and HTML reporting.

Installation

bash

sudo apt install vinetto

Flags

-h, -?, --helpshow this help message and exit, use -v for more details

-e, --edb EDBFILEexamine EDBFILE (Extensible Storage Engine Database) for original thumbnail filenames. NOTE: -e without an INFILE explores EDBFILE extracted data. NOTE: Automatic mode will attempt to use ESEDB without -e

-H, --htmlrepwrite html report to DIR (requires option -o)

-m, --mode [{f,d,r,a}]operating mode: "f", "d", "r", or "a"

--md5enable MD5 hashing

--nomd5disable MD5 hashing

-o DIRoutput directory

-qquiet mode

-ssimple mode

-Uupdate mode

-vverbose mode

--versionshow version

Examples

Display help message and usage information for vinetto

vinetto -h

Process a single thumbnail file (Thumbs.db or similar) depending on operating mode

vinetto infile

Process a directory of thumbnail files depending on operating mode

vinetto /path/to/directory

Examine an EDB file for original thumbnail filenames without specifying an infile

vinetto -e edbfile.edb

Process infile in file mode (f)

vinetto -m f infile

Process directory in directory mode (d)

vinetto -m d /path/to/dir

Recursively process directory in recursive mode (r)

vinetto -m r /path/to/dir

Updated 2026-04-16kali.org ↗