Skip to content
LinuxForensics

File accessUser activityUSB & devices

Linux Thumbnail Cache: ~/.cache/thumbnails Forensics

The freedesktop thumbnail cache on Linux: PNG previews named by the MD5 of the file URI, holding path and mtime, that outlive deleted files.

Location
~/.cache/thumbnails/{normal,large,x-large,xx-large,fail}/
Distributions
Proves
That a user's file manager or file chooser displayed a given image, video or document, where it was stored and what it looked like
Timestamps
Thumb::MTime = source file mtime in Unix seconds; PNG file birth/mtime approximate when the thumbnail was generated
Access
Any user for their own cache (mode 0700 directories, 0600 files); root for other users
Retention
Until the cache is cleared; GNOME housekeeping purges thumbnails older than 180 days or beyond 512 MB by default
Collection
UAC, Velociraptor, cp -a, tar

Tools

Compare all tools

What it is

The freedesktop.org Thumbnail Managing Standard defines one shared cache of preview images for all desktop applications. When GNOME Files, Dolphin, Thunar, Nemo, Eye of GNOME, a GTK file chooser or any other compliant program shows a preview, it stores a PNG named after the MD5 hash of the file's URI. The PNG carries text chunks with the original URI and the source file's modification time.

This is the Linux counterpart of the Windows thumbcache. The key property is the same: the thumbnail stays after the original is deleted, renamed away or on a USB stick that has since been unplugged.

Where it lives

ItemPathNotes
Cache root$XDG_CACHE_HOME/thumbnails, normally ~/.cache/thumbnails/Spec 0.8.0 and later
Normal sizenormal/<md5>.pngUp to 128x128
Largelarge/<md5>.pngUp to 256x256, GNOME's usual default
Extra sizesx-large/ (512), xx-large/ (1024)Added in later spec versions; used by recent GNOME and KDE at high zoom or HiDPI
Failuresfail/<app-name-version>/<md5>.pngFiles the thumbnailer could not render; still record the URI
Legacy~/.thumbnails/Desktops from before about 2012; check old home directories migrated across upgrades
Shared repository.sh_thumbnails/{normal,large}/ next to the filesOptional, on read-only or removable media; named by MD5 of the file name only

What it proves

  • The file, identified by full URI, was displayed at least once in a thumbnail-capable view by this user.
  • What it looked like, even when the original is gone: a 256 or 512 pixel preview of a photo or the first page of a PDF is often enough.
  • Where it was stored: file:///media/alice/KINGSTON/... or file:///run/media/... places the file on removable media, smb:// and sftp:// URIs on network shares.
  • The source file's mtime at the moment of thumbnailing, via Thumb::MTime.
  • It does not prove the user opened the file, only that it was listed with previews enabled. It also says nothing about who created the file.

Key fields

Text chunks inside each PNG (tEXt or iTXt):

KeyMeaning
Thumb::URICanonical, percent-encoded URI of the source file (required)
Thumb::MTimeSource file mtime, Unix seconds (required)
Thumb::SizeSource file size in bytes (optional)
Thumb::MimetypeSource MIME type (optional)
Thumb::Image::Width / Height, Thumb::Document::Pages, Thumb::Movie::LengthMedia details, when the thumbnailer writes them
SoftwareProgram that created the thumbnail, for example GNOME's thumbnail factory or KDE's KIO

The file name is md5(URI) in lower-case hex. To test whether a specific file was ever thumbnailed, compute the hash of its exact URI:

printf '%s' 'file:///home/alice/Pictures/site%20plan.png' | md5sum
# then look for <hash>.png under every size directory

Spaces and non-ASCII characters must be percent-encoded exactly as the desktop encoded them, or the hash will not match.

Timestamps

Thumb::MTime is the source file's mtime in UTC epoch seconds when the preview was built. If a file with the same URI later shows a different mtime, the thumbnailer regenerates the PNG, so a mismatch between Thumb::MTime and the current file means the file changed after the last preview.

The PNG's own birth time (ext4 or XFS v5 crtime) approximates the first time the file was listed with previews; its mtime reflects the last regeneration. Neither is guaranteed, because copying the cache to a new home directory resets them.

Retention

GNOME's settings daemon purges the cache through the org.gnome.desktop.thumbnail-cache keys maximum-age (180 days by default) and maximum-size (512 MB by default); -1 disables cleaning. KDE and Xfce do not purge by age by default, so caches of several years are common there. Users can clear it with "Clear thumbnail cache" style privacy tools, BleachBit or a plain rm -rf ~/.cache/thumbnails, which leaves the directory birth time newer than the rest of ~/.cache.

Collection

# Dead box
cp -a /mnt/evidence/home/*/.cache/thumbnails /mnt/evidence/home/*/.thumbnails /cases/2026-017/thumbs/ 2>/dev/null
# Shared repositories on seized media
find /mnt/usb -type d -name .sh_thumbnails

UAC's stock artifacts do not include the thumbnail cache at the time of writing, so add a custom file collector for %user_home%/.cache/thumbnails to your profile. With Velociraptor, glob /home/*/.cache/thumbnails/**/*.png.

Parsing

ExifTool reads the PNG text chunks and scales to thousands of files:

exiftool -r -csv -PNG:Thumb* -FileModifyDate /cases/2026-017/thumbs > thumbs.csv
exiftool -a -G1 -s large/3f5c8e...png

Sort thumbs.csv by ThumbURI to group by directory, then view the PNGs in any image viewer that does not itself write thumbnails (open copies, not the evidence).

Investigator tips

  • Filter on file:///media/, file:///run/media/ and file:///mnt/ to list files seen on external drives, then pair the volume labels with USB device records.
  • Compare every Thumb::URI against the file system: URIs that no longer resolve are deleted or moved files, and the thumbnail may be the only copy left. Check the Trash too.
  • Entries under fail/ also prove a file was listed; malformed or encrypted archives and odd file types often end up there.
  • Previews in large/ and x-large/ for the same URI were generated at different zoom levels or on different displays, which helps show repeated browsing.
  • Sandboxed apps (snap, Flatpak) may keep their own cache under ~/snap/<app>/ or ~/.var/app/<id>/cache/thumbnails/.

See also