vinetto

No entries match these filters. Clear filters

1. docs update Oct 10, 2026 · issue 101

   Vinetto 0.9.15 parses Windows Thumbs.dbThumbs.dbA hidden Windows file that stores cached thumbnail images of pictures in a folder, created automatically by Explorer; cyber tools parse it to recover evidence of files that may have since been deleted. and Thumbcache_*.dbThumbcache_*.dbWindows thumbnail cache files stored in a user's profile that record small image previews of files the user has browsed, giving cyber tools a source of evidence for files that may no longer exist on disk. files across four operating modes with ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. cross-referencing and HTML reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Automatically process a mounted Windows partition image to extract all user thumbcache thumbnails and cross-reference filenames against Windows.edb, writing images and an HTML report to an output directory.
   copy

   $ vinetto -m a -e /mnt/windows/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb -o ./extracted_thumbs -H /mnt/windows

   Recursively scan a directory tree for all *.db thumbnail files, recover original filenames via a Windows.edb, and create symlinks from real names to numbered thumbnails — useful when investigating a disk image with many user directories.
   copy

   $ vinetto -m r -e ./Windows.edb -o ./out -s ./evidence/Users

   Parse a single Thumbcache_256.db file with full verbose output and forced MD5 hashing, writing extracted images to disk — useful when you want maximum detail on a specific cache file regardless of its size.
   copy

   $ vinetto -m f --md5 -v -v -v -o ./thumbs ./evidence/Thumbcache_256.db

   • Adds -m [{f,d,r,a}] / --mode flag to select operating mode: f (single file), d (directory), r (recursive directory), or a (automatic Windows partition processing via well-known paths like Users/*/AppData/Local/Microsoft/Windows/Explorer/)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -e EDBFILE / --edb flag to cross-reference Thumb Cache IDs against a Windows.edb (ESEDB) file to recover original filenames; running -e without INFILE explores the ESEDB directly
   • Adds -H / --htmlrep flag to write an HTML report to the directory specified by -o
   • Adds --md5 and --nomd5 flags to force or skip MD5 hash calculation for input files (default threshold: files under 0.5 GiB are hashed automatically; --nomd5 overrides --md5)
   • Adds -o DIR / --outdir flag to write extracted thumbnail images to a specified output directory

   +5 more show less

   • Adds -s / --symlinks flag to create symlinks from the real image filename to the numbered name in DIR/.thumbs, requiring -o and either a Catalog with real names or a Windows.edb via -e
   • Adds -U / --utf8 flag to force UTF-8 encodings during processing
   • Adds -v / --verbose flag with incremental output levels: 0 (Standard), 1 (Verbose), 2 (Enhanced), 3 (Full); also exposes extended help when used with -h
   • Adds -q / --quiet flag for errors-only output (overridden by -v)
   • Reports structured exit codes: 0 (normal), 2 (argument parsing), 10 (input errors), 11 (output errors), 12 (processing errors), 13 (install errors), 14 (entry errors), 15 (symlink errors), 16 (mode errors), 17 (HTML report errors), 18 (ESEDB file errors)

   10 details in Everything

2. docs update Oct 10, 2026 · issue 101
   └──▷ TRY IT
   Automatically extract all thumbnails from a mounted Windows partition image and cross-check filenames against Windows.edb — covers all user profiles at once.
   copy

   $ vinetto -m a -e /mnt/windows/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb -o ./output -H /mnt/windows

   Recursively process all thumb cache files from a suspect directory, skip the MD5 hash step for speed on large volumes, and emit an HTML report.
   copy

   $ vinetto -m r --nomd5 -o ./thumbs -H ./suspect_drive

   Extract a single Thumbcache file with symlinks to real filenames (requires a Windows.edb for name resolution) for quick triage in a case directory.
   copy

   $ vinetto -m f -e ./Windows.edb -o ./case_thumbs -s ./Thumbcache_256.db

3. docs update Oct 10, 2026 · issue 101

   vinetto: Processes Thumbcache_*.dbThumbcache_*.dbWindows thumbnail cache files stored in a user's profile that record small image previews of files the user has browsed, giving cyber tools a source of evidence for files that may no longer exist on disk. and Thumbs.dbThumbs.dbA hidden Windows file that stores cached thumbnail images of pictures in a folder, created automatically by Explorer; cyber tools parse it to recover evidence of files that may have since been deleted. files to extract JPEG, PNG, and BMP thumbnails from Windows systems.

   └──▷ TRY IT
   Automatically process a mounted Windows partition to extract all user thumbcache thumbnails and cross-reference filenames against the default Windows.edb location.
   copy

   $ vinetto -m a -o /output/thumbs /mnt/windows

   Recursively scan a Windows user profile directory, cross-reference Thumb Cache IDs with a specific ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. file, and produce an HTML report with symlinked real filenames.
   copy

   $ vinetto -m r -e /evidence/Windows.edb -H -s -o /output/report /mnt/windows/Users/Suspect

   Explore metadata from a Windows.edb file alone (no thumbnail input file) to enumerate indexed image paths before running a full extraction.
   copy

   $ vinetto -e /evidence/Windows.edb

   └──▷ BREAKING ON UPGRADE

   • !Python 2 compatible code has been removed since version 0.9.9; Python 3.12 or later is required.
4. docs update Oct 10, 2026 · issue 101

   Vinetto 0.9.17 adds four operating modes (f/d/r/a), ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. cross-referencing (-e), HTML reporting (-H), symlink creation (-s), and structured exit codes.

   • Adds -m/--mode flag supporting four operating modes: f (file), d (directory), r (recursive), and a (automatic) for flexible thumb cache processing scope.
   • Adds -e/--edb EDBFILE flag to cross-reference Thumb Cache IDs against a Windows.edb ESEDB file to recover original filenames; using -e without INFILE explores ESEDB extracted data directly.
   • Adds -H/--htmlrep flag to write an HTML report to the output directory (requires -o).
   • Adds --md5 and --nomd5 flags to force or skip MD5 hash calculation for input files, with --nomd5 overriding --md5; by default MD5 is calculated for files under 0.5 GiB.
   • Adds -o/--outdir DIR flag to write extracted thumbnails to a specified directory.

   +5 more show less

   • Adds -s/--symlinks flag to create symlinks from real image names to numbered names in DIR/.thumbs when a Catalog or Windows.edb is available.
   • Adds -U/--utf8 flag to force UTF-8 encodings during processing.
   • Adds -v/--verbose flag with four incremental output levels: 0 (Standard), 1 (Verbose), 2 (Enhanced), 3 (Full); -q/--quiet suppresses all output except errors.
   • Adds structured exit codes (0, 2, 10–18) covering normal termination, argument errors, input/output/processing/install/entry/symlink/mode/report/ESEDB errors.
   • New supported platformAutomatic mode (-m a) resolves Thumbcache_*.dbThumbcache_*.dbWindows thumbnail cache files stored in a user's profile that record small image previews of files the user has browsed, giving cyber tools a source of evidence for files that may no longer exist on disk. files from BASE/Users/*/AppData/Local/Microsoft/Windows/Explorer/ and locates Windows.edb at BASE/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb without requiring -e.

   10 details in Everything

5. docs update Oct 10, 2026 · issue 101

   vinetto: Adds -m/--mode flag accepting f, d, r, or a to control processing mode for files, directories, recursive trees, or automatic Windows partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Triage a mounted Windows partition image automatically, resolving all thumbcache and Windows.edb paths without specifying them manually.
   copy

   $ vinetto -m a /mnt/windows_partition -o ./output_thumbs -H

   Extract thumbnails from a single Thumbcache file and cross-reference with a Windows.edb to recover original filenames for deleted images.
   copy

   $ vinetto -m f -e /mnt/evidence/Windows.edb -o ./recovered_thumbs -s /mnt/evidence/Users/John/AppData/Local/Microsoft/Windows/Explorer/Thumbcache_256.db

   Recursively scan a suspect user profile directory for all thumbnail databases and produce verbose output to trace missing or deleted image entries.
   copy

   $ vinetto -m r -vvv -o ./thumbs_out /mnt/evidence/Users/John

   • Supports automatic mode (-m a) that resolves Thumbcache_*.dbThumbcache_*.dbWindows thumbnail cache files stored in a user's profile that record small image previews of files the user has browsed, giving cyber tools a source of evidence for files that may no longer exist on disk. files from BASE/Users/*/AppData/Local/Microsoft/Windows/Explorer/ and Windows.edb from BASE/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb without manual path specification.

   1 detail in Everything

6. docs update Oct 10, 2026 · issue 101

   Vinetto gains -i/--invert flag for color-negative Type 1 thumbnails and now prefers system-installed pyesedb over its bundled copy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Recover color-correct thumbnails from a Thumbs.dbThumbs.dbA hidden Windows file that stores cached thumbnail images of pictures in a folder, created automatically by Explorer; cyber tools parse it to recover evidence of files that may have since been deleted. where Type 1 images were stored as color negatives.
   copy

   $ vinetto -i -o ./output Thumbs.db

   • Adds -i/--invert flag to color-invert Type 1 thumbnail images (useful when Thumbs.db stores color negatives).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. library loading now checks for a system-installed pyesedb before falling back to Vinetto's bundled version.
   • Requires Python 3.7 or later and Pillow 9.0.0 or later; Python 2 compatibility code has been removed.
   • Adds -i/--invert flag to color-invert Type 1 thumbnail images (useful when Thumbs.db stores color negatives).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 2 compatibility code has been removed; Vinetto now requires Python 3.7 or later.
   • !Pillow 9.0.0 or later is now a required dependency.
7. v0.9.9 Feb 1, 2022 · release notes

   Adds -i / --invert flag to Vinetto v0.9.9 to invert colors of Type 1 images.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.9 https://github.com/AtesComp/Vinetto.git
   # already have the repo? check out this version:
   $ git checkout v0.9.9

   └──▷ TRY IT
   Generate a negative image for forensic analysis or specific visualization requirements.
   copy

   $ vinetto -i <path_to_vst1_file>

   • Adds -i, --invert option to invert colors (negatives) for Type 1 images
   • Updates underlying ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. library based on libesedb commit 3326953

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 2 compatibility code has been removed; Vinetto now requires Python 3
8. v0.9.6 Feb 8, 2020 · release notes

   Vinetto v0.9.6 adds Automatic mode (-a) and Windows.edb ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. integration for Thumb Cache analysis

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.6 https://github.com/AtesComp/Vinetto.git
   # already have the repo? check out this version:
   $ git checkout v0.9.6

   └──▷ USE IT
   Automatically scan a Windows partition for all Thumb Cache files and resolve metadata using Windows.edb.
   shell copy

   vinetto -a /path/to/windows/partition

   Launch the interactive ESEDB Explorer to inspect image-related records without processing a specific cache file.
   shell copy

   vinetto Windows.edb

   • Adds -a automatic mode to discover and process Thumbcache_*.dbThumbcache_*.dbWindows thumbnail cache files stored in a user's profile that record small image previews of files the user has browsed, giving cyber tools a source of evidence for files that may no longer exist on disk. files and auto-load Windows.edb
   • Adds support for processing Windows.edb ESEDB files to resolve Thumb Cache IDs to filenames
   • Adds ESEDB Explorer invoked when providing only an ESEDB file as input

   3 details in Everything

9. 0.9.4 Jan 31, 2020 · release notes

   Vinetto 0.9.4 introduces structured error classes and documented quiet mode (-q) for CLI output control.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.4 https://github.com/AtesComp/Vinetto.git
   # already have the repo? check out this version:
   $ git checkout 0.9.4

   • Introduces specific Error Classes for programmatic exception handling

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Exit codes have been consolidated and renamed; scripts relying on old numeric exit codes may need updating
10. 0.8.8 Jan 9, 2020 · release notes

    vinetto 0.8.8 adds more columns to ESEDBESEDBA binary database format used by Microsoft applications—including Exchange, Active Directory, and Windows Search—to store structured data; cyber tools parse it to extract artifacts from these sources. data and shows file extensions in HTML reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.8 https://github.com/AtesComp/Vinetto.git
    # already have the repo? check out this version:
    $ git checkout 0.8.8

    • Adds additional related columns to the ESEDB data output schema
    • Adds file extension processing in image row display for HTML reports

    2 details in Everything

11. 0.8.5 Dec 27, 2019 · release notes

    Adds --edb switch and a mode for automated thumbnail cache analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.5 https://github.com/AtesComp/Vinetto.git
    # already have the repo? check out this version:
    $ git checkout 0.8.5

    • Introduces -e, --edb CLI argument to specify a Windows.edb input file for resolving original thumbnail filenames
    • Adds a (automatic) mode switch to automatically scan a directory for default Windows Vista+ locations of thumbcache_*.db and Windows.edb files
    • Adds new HTML Report functions to process multiple thumbcache_#.db files

    3 details in Everything

12. 0.8.4 Nov 15, 2019 · release notes

    Vinetto 0.8.4 adds --md5/--nomd5 flags, --mode for directory scanning, and thumbcache_*.db support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.4 https://github.com/AtesComp/Vinetto.git
    # already have the repo? check out this version:
    $ git checkout 0.8.4

    └──▷ TRY IT
    Force MD5 hash generation for a thumbcache file.
    copy

    $ vinetto --md5 thumbcache.db

    Scan a directory for common thumbnail filenames using vinetto.
    copy

    $ vinetto --mode d /path/to/thumbnails

    • Adds --md5 flag to force MD5 calculation as per previous behavior
    • Adds --nomd5 flag to disable MD5 calculation
    • Adds --mode switch with d and r values for directory-based thumbnail file name scanning
    • Adds support for processing thumbcache_*.db files identified by file signatures

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Default MD5 calculation behavior changed from always to only when the file size is less than 500 MiB
13. 0.8.0 Oct 28, 2019 · release notes

    vinetto 0.8.0 adds thumbnail structure checks, endian control, and Python 3 compliance.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.0 https://github.com/AtesComp/Vinetto.git
    # already have the repo? check out this version:
    $ git checkout 0.8.0

    • Expands exit codes to provide granular error status reporting

    1 detail in Everything