Skip to content

Thumbnail cache

Definition

A store of small preview images generated by the OS or applications when media is first viewed. On Android the primary cache is stored in a .thumbnails directory or a MediaStore database; on iOS thumbnails are managed by the Photos framework in DCIM and PhotoData directories. Caches are evicted on their own schedule, independent of source file deletion.

Related terms

File-based encryption (FBE)
An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
NAND flash erase block
The minimum unit that can be electrically erased in NAND flash memory. Erase blocks are larger than write pages (often 256 KB...
SQLite free page
A database page that SQLite has placed on an internal free-page list after a row deletion. The page retains its original content...
TRIM
A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
Wear levelling
A flash controller algorithm that distributes write operations across all blocks evenly to prevent any single block from wearing out prematurely. A...

Explained in

  • Deleted Data Recovery on Mobile DevicesA store of small preview images generated by the OS or applications when media is first viewed. On Android the primary cache is stored in a .thumbnails directo...

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.