VINETTO(1)

💖 vinetto(1) — the manual page, but make it a group chat 💖

okay so this is the manual for vinetto, and bestie, it is lowkey iconic. forensics girlies stay winning. ✨

---

🌸 NAME 🌸

vinetto — extract thumbnails and associated metadata from Thumbs.db files 💅

🌈 SYNOPSIS 🌈

vinetto [OPTION] [-o DIR] file

✨ DESCRIPTION ✨

so what does vinetto actually do? it extracts the thumbnails and the associated metadata from Thumbs.db files. that's the whole vibe. 🎀

here's the lore: MS Windows systems (that's 98, ME, 2000, XP and 2003 Server) can store thumbnails and metadata of the picture files that live in directories. those thumbnails and their associated metadata get stored in Thumbs.db files — which are, no cap, undocumented OLE structured files. 🙈

and here's the part that makes it chef's kiss for forensics: once a picture file has been deleted from the filesystem, the related thumbnail and associated metadata remain stored in the Thumbs.db file. so the data hanging out inside Thumbs.db files is a genuinely helpful source of information for the forensics investigators. it's giving evidence that never left the chat. 💀

so vinetto will help *nix-based forensics investigators to:

• easily preview thumbnails of deleted pictures on Windows systems;
• obtain information (dates, path, ...) about these deleted pictures.

👑 OPTIONS 👑

one bullet per flag, no skipping, we list them ALL. periodt.

• --version — shows the program's version number and exits. bye bestie 👋
• -h, --help — shows the help message and exits.
• -o DIR — writes thumbnails to DIR. 📁
• -H — writes an html report to DIR (requires option -o). yes, it needs -o, it's a package deal fr fr.
• -U — use utf8 encodings. 🌸
• -s — creates a symlink of the picture realname to the numbered name in DIR/.thumbs. (requires option -o). NOTE: a Catalog containing the realname must exist for this option to produce results.

💅 EXAMPLES 💅

display metadata contained within a Thumbs.db file:

$ vinetto /path/to/Thumbs.db

extract the related thumbnails to a directory:

$ vinetto -o /tmp/vinetto_output /path/to/Thumbs.db

extract the related thumbnails to a directory AND produce a HTML report so you can preview these thumbnails through your favorite browser:

$ vinetto -Ho /tmp/vinetto_output /path/to/Thumbs.db

get a metadata report on all non deleted Thumbs.db files contained within a partition:

$ find /mnt/sda2 -iname thumbs.db -printf "\n==\n %p \n\n" -exec vinetto {} \; 2>/tmp/vinetto_err.log >/tmp/vinetto_sda2.txt

🫶 TIP 🫶

vinetto can generate its results in hidden directories, as .thumbs. sneaky. love that for us. 🌚

😭 BUGS 😭

MS Windows stores thumbnails in its Thumbs.db files according to various formats. at present, vinetto does not produce an excellent reconstruction of Type 1a thumbnails. see more details and examples here[1].

[1] http://vinetto.sf.net/docs.html

also, in 0.07 version, vinetto can crash when used without the -o option. 💀 if this command crashes:

$ vinetto /path/to/Thumbs.db

please, try this:

$ vinetto -o . /path/to/Thumbs.db

it will show metadata and extract the thumbs (maybe an undesirable result). but it won't crash. 🎀

bestie, note that "maybe an undesirable result" thing is real — the workaround has a side effect, so don't say we didn't warn you.

🦋 AUTHOR 🦋

vinetto was written by Michel Roukine <rukin@users.sf.net>.

this manual page was written by Danny van der Meeren <danny@illogic.nl> and updated by Joao Eriberto Mota Filho <eriberto@debian.org> and Giovani Augusto Ferreira <giovani@debian.org> for Debian project (but may be used by others).

---

and that's the whole page, bestie. this was VINETTO 0.8.0, dated Nov 2019 — slay, we stan a documented forensics tool. go preview some deleted pictures responsibly. 💜🌸✨