ThumbsDBkit

thumbsdbkit 是一个用于分析 Microsoft Thumbs.db 文件的取证命令行工具；

安装

使用 cargo

cargo install thumbsdbkit

用法

$ thumbsdbkit --help
ThumbsDBkit 1.0.1


USAGE:
    thumbsdbkit [SUBCOMMAND]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

SUBCOMMANDS:
    extract    Extract thumbnails
    help       Prints this message or the help of the given subcommand(s)
    ls         List thumbnails

列出缩略图的方法： ls 命令

$ thumbsdbkit help ls
thumbsdbkit-ls
List thumbnails

USAGE:
    thumbsdbkit ls [FLAGS] <FILE>

FLAGS:
        --color      colorize the output
    -d, --details    print more details for each entry
    -h, --help       Prints help information
    -i, --idirid     print the index number of each file
    -V, --version    Prints version information

ARGS:
    <FILE>    Thumbs.db to analyze

提取缩略图的方法： extract 命令

$ thumbsdbkit help extract
thumbsdbkit-extract
Extract thumbnails

USAGE:
    thumbsdbkit extract <FILE> --out <OUTDIR>

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -o, --out <OUTDIR>    Output directory where extracted thumbnails will be stored

ARGS:
    <FILE>    Thumbs.db to analyze

许可证

http://www.wtfpl.net/about/