This effect is more clearly seen when accessing a DVD containing thousands of photos without the thumbs.db file and setting the view to show thumbnails next to the filenames.
[3] Windows XP Media Center Edition also creates ehthumbs.db which holds previews of video files.
[4] Beginning with Windows Vista, thumbnail previews are stored in a centralized location on the system.
[5] Law-enforcement agencies have used this file to prove that illicit photos were previously stored on the hard drive.
It identified that whilst there is a standard definition of a thumbnail cache the structure and forensic artifacts recoverable from them varies significantly between operating systems.
The work also showed that the thumbcache_256.db contains non-standard thumbnail cache records which can store interesting data such as network place names and allocated drive letters.