Tag: thumbnails

Disable Windows Vista/7/8/8.1 Thumbnail Caches (Privacy, Performance, Paranoia, and Anti-Forensics)

By default, every version of Windows since XP creates thumbnail database files that store small versions of every picture in every folder you browse into with Windows Explorer. These files are used to speed up thumbnail views in folders, but they have some serious disadvantages:

  1. They are created automatically without ever asking you if you want to use them.
  2. Deleting an image file doesn’t necessary delete it from the thumbnail database. The only way to delete the thumbnail is to delete the database (and hope you deleted the correct one…and that it’s not stored in more than one database!)
  3. These files consume a relatively small amount of disk space.
  4. The XP-style (which is also Vista/7/8 style when browsing network shares) “Thumbs.db” and the Windows Media Center “ehthumbs_vista.db” files are marked as hidden, but if you make an archive (such as a ZIP file) or otherwise copy the folder into a container that doesn’t support hidden attributes, not only does the database increase the size of the container required, it also gets un-hidden!
  5. If you write software, it can interfere with software version control systems. They may also update the timestamp on the folder they’re in, causing some programs to think your data in the folder has changed when it really hasn’t.
  6. If you value your privacy (particularly if you handle any sort of sensitive information) these files leave information behind that can be used to compromise that privacy, especially when in the hands of anyone with even just a casual understanding of forensic analysis, be it the private investigator hired by your spouse or the authorities (police, FBI, NSA, CIA, take your pick).

To shut them off completely, you’ll need to change a few registry values that aren’t available through normal control panels (and unavailable in ANY control panels on any Windows version below a Pro, Enterprise, or Ultimate version). Fortunately, someone has already created the necessary .reg files to turn the local thumbnail caches on or off in one shot. The registry file data was posted by Brink to SevenForums. The files at that page will disable or enable this feature locally. These will also shut off (or turn on) Windows Vista and higher creating “Thumbs.db” files on all of your network drives and shares.

If you want to delete all of the “Thumbs.db” style files on a machine that has more than a couple of them, open a command prompt (Windows key + R, then type “cmd” and hit enter) and type the following commands (yes, the colon after the “a” is supposed to be followed by an empty space):

cd \

del /s /a: Thumbs.db

del /s /a: ehthumbs_vista.db

This will enter every directory on the system hard drive and delete all of the Thumbs.db files. You may see some errors while this runs, but such behavior is normal. If you have more drives that need to be cleaned, you can type the drive letter followed by a colon (such as “E:” if you have a drive with that letter assigned to it, for example) and hit enter, then repeat the above two commands to clean them.

The centralized thumbnail databases for Vista and up are harder to find. You can open the folder quickly by going to Start, copy-pasting this into the search box with CTRL+V, and hitting enter:

%LOCALAPPDATA%\Microsoft\Windows\Explorer

Close all other Explorer windows that you have open to unlock as many of the files as possible. Delete everything that you see with the word “thumb” at the beginning. Some files may not be deletable; if you really want to get rid of them, you can start a command prompt, start Task Manager, use it to kill all “explorer.exe” processes, then delete the files manually using the command prompt:

cd %LOCALAPPDATA%\Microsoft\Windows\Explorer

del thumb*

rd /s thumbcachetodelete

When you’re done, either type “explorer” in the command prompt, or in Task Manager go to File > New Task (Run)… and type “explorer”. This will restart your Explorer shell so you can continue using Windows normally.

Completely disable Firefox disk caching and thumbnail generation for speed and paranoia

A comment on an article on Ars Technica reminded me that people have been convicted of possession of child pornography in the past based solely on the contents of their web browser’s cache (Internet Explorer calls them “temporary internet files.”) The problem with this is that these days, you don’t necessarily have to see or click on anything to have it load into your browser cache. Ignoring questionable ads and unexpected pop-ups and someone else touching your computer as a source of such garbage, actual “features” like link prefetching can do this by loading the contents of certain links on a page in anticipation of you clicking through them while never necessarily doing so. It’s pretty scary to think about such things, but they can and do happen, and if some forensic guy ever sees the contents of your hard drive, you don’t want to have to worry about some prefetched stuff you didn’t know was there landing you in hot water, especially in the “guilty until proven innocent” manner criminal court juries tend to operate.

Torrents, private emails, and other things that aren’t necessarily illegal at all (yet definitely deserve to be kept private) are stored in your browser cache, too. Even if you’re not concerned about the remnants of the virus you just got quarantined having opened questionable websites for you, you might not want copies of your email to your boss with whom you’re having an affair being found by your nosy significant other, or you might have caught your kids downloading something they shouldn’t have using BitTorrent and want to make sure records of their faux pas isn’t floating about in the browser cache for the next few months.

Then there’s the technical aspect: more files on disk is generally a bad thing, because a folder with 5,000 entries is far slower to search through for one file than a folder with 100 entries (or no folders at all). Wouldn’t it be awesome to alleviate both the paranoid legal risk as well as speed up your browser and prevent it from polluting your hard drive with thousands of files you don’t care about? If you use Mozilla Firefox, it’s actually somewhat simple to turn off prefetching and disk caching once you know how. Note that memory caching is still in place, so you do still have the speed benefits of caching; note also that memory caching can still end up in your paging file, so this isn’t a 100% foolproof thing, but in terms of eliminating risk it’s a huge leap forward.

  1. Open Firefox. Go to the address bar, type about:config and hit [Enter].
  2. It might warn you not to play around. Click “I’ll be careful, I promise!”
  3. Type “prefetch” into the search box. You should see an option called “network.prefetch-next” which you can double-click to change to “false.”
  4. Search for “cache.disk” this time. Change “browser.cache.disk.enable” to “false” and change “browser.cache.disk.capacity” to “0.”
  5. Close and re-open Firefox.
  6. Hit [Ctrl] + [Shift] + [Delete] to bring up the “Clear Recent History” box. Change your time range to “Everything” and make sure “Cache” is checked. This erases the entire disk cache.
  7. For the really paranoid, install CCleaner (don’t install anything else it offers to install while you do it), find the “Wipe Free Space” option at the bottom of the left column, right-click on it, and choose “clean.” (It might warn you that it’s going to delete stuff, but proceed anyway.) This erases the contents of all of the empty space on the hard drive, including anything that was in the disk cache you just deleted and anything that has ever been deleted from the computer.
  8. [Update for newer Firefox versions] Firefox stores thumbnails of pages you visit for the new “New Tab” page previews. To get rid of this while you’re in about:config, right-click somewhere and go to New -> Boolean, call it browser.pagethumbnails.capturing_disabled and set it to true. Restart Firefox and no more behind-your-back thumbnails.

While you’re at it, you might want to install NoScript and Adblock Plus, and learn how to use them to protect against these things landing on your browser in the first place, but that’s beyond the scope of this post. Happy faster browsing, and tell your boss in your next email that I’ll see her this weekend. 😉 xoxo