SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Appendix A Thumbnail Cache File Structures
A.1 Windows 7 Thumbnail Cache Structure
A.1.1 IDX File Header Structure
typedefstruct {
CHAR FileSignature[4]; // 4 bytes
DWORD Version; // 4 bytes
DWORD CacheNo; // 4 bytes
DWORD HeaderSize; // 4 bytes
DWORD NumRecordsUsed; // 4 bytes
DWORD HashTableSize; // 4 bytes
} ThumbcacheIDXHeader7;
The version number is 20 for Windows Vista and 21 for Windows 7
The CacheNo is 0 for 32, 1 for 96, 2 for 256, 3 for 1024 and 4 for sr
A.1.2 IDX Record Structure
typedefstruct {
UQUAD HashTableKey; // 8 bytes
UINT flags; // 4 bytes
UINT Position32; // 4 bytes
UINT Position96; // 4 bytes
UINT Position256; // 4 bytes
UINT Position1024; // 4 bytes
UINT Positionsr; // 4 bytes
} ThumbcacheIDXRecord7;
The record structure repeats throughout the idx file; the number of records present is
always a multiple of 101. If a position field contains FF FFFFFF, then there is no
associated image of that size for the record. If the position is 00 00 00 00 then the
whole record should be empty.
Cranfield University |
311