  Today, in digital forensics, images normally provide important information
within an investigation. However, not all images may still be available within
a forensic digital investigation as they were all deleted for example. Data
carving can be used in this case to retrieve deleted images but the carving
time is normally significant and these images can be moreover overwritten by
other data. One of the solutions is to look at thumbnails of images that are no
longer available. These thumbnails can often be found within databases created
by either operating systems or image viewers. In literature, most research and
practical focus on the extraction of thumbnails from databases created by the
operating system. There is a little research working on the thumbnails created
by the image reviewers as these thumbnails are application-driven in terms of
pre-defined sizes, adjustments and storage location. Eventually, thumbnail
databases from image viewers are significant forensic artefacts for
investigators as these programs deal with large amounts of images. However,
investigating these databases so far is still manual or semi-automatic task
that leads to the huge amount of forensic time. Therefore, in this paper we
propose a new approach of automating extraction of thumbnails produced by image
viewers. We also test our approach with popular image viewers in different
storage structures and locations to show its robustness.
