vinetto - Online in the Cloud

PROGRAM:

NAME

vinetto - extract thumbnails and associated metadata from Thumbs.db files

SYNOPSIS

vinetto [OPTION] [-o DIR] file

DESCRIPTION

vinetto extracts the thumbnails and associated metadata from the Thumbs.db files.

The MS Windows systems (98, ME, 2000, XP and 2003 Server) can store thumbnails and
metadata of the picture files contained in directories. The thumbnails and associated
metadata are stored in Thumbs.db files (that are undocumented OLE structured files). Once
a picture file has been deleted from the filesystem, the related thumbnail and associated
metadata remain stored in the Thumbs.db file. So, the data contained in Thumbs.db files
are a helpful source of information for the forensics investigators.

vinetto will help *nix-based forensics investigators to:

· easily preview thumbnails of deleted pictures on Windows systems;

· obtain information (dates, path, ...) about these deleted pictures.

OPTIONS

--version
Show program's version number and exit.

-h, --help
Show help message and exit.

-o DIR Write thumbnails to DIR

-H Write html report to DIR

-U Use utf8 encodings.

-s Create symlink of the picture realname to the numbered name in DIR/.thumbs.

EXAMPLES

Display metadata contained within a Thumbs.db file:

$ vinetto /path/to/Thumbs.db

Extract the related thumbnails to a directory:

$ vinetto -o /tmp/vinetto_output /path/to/Thumbs.db

Extract the related thumbnails to a directory and produce a HTML report to preview these
thumbnails through your favorite browser:

$ vinetto -Ho /tmp/vinetto_output /path/to/Thumbs.db

Get a metadata report on all non deleted Thumbs.db files contained within a partition:

$ find /mnt/sda2 -iname thumbs.db -printf "\n==\n %p \n\n" -exec vinetto {} \; 2>/tmp/vinetto_err.log >/tmp/vinetto_sda2.txt

TIP

vinetto can generate its results in hidden directories, as .thumbs.

Use vinetto online using onworks.net services