Earlier this year Mari DeGrazia presented a tool to parse the Quicklook thumbnails index.sqlite file. The file is located under /private/var/folders/<random>/<random>/C/com.apple.QuickLook.thumbnailcache. Now she researched another file in this folder – thumbnails.data. The thing is: popular carvers won’t extract images from it, so she has written a nice Python script for extracting data from it. Also, you can learn more about these files in her blog.
DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.
