THUMBS.DB file signature
A Windows thumbnail cache file begins with the bytes D0 CF 11 E0 A1 B1 1A E1 at the start of the file. The signature is the same whatever the file is named, which is why a renamed or extensionless THUMBSDB file is still recognisable.
Signature
| Offset | Hex | ASCII |
|---|---|---|
| 0 | D0 CF 11 E0 A1 B1 1A E1OLE2 compound document. |
MIME type: application/octet-stream · usual extensions: Thumbs.db
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 fileThumbs.db
file fileThumbs.dbWindows (PowerShell):
Format-Hex -Path fileThumbs.db -Count 32If the bytes do not match
A file named Thumbs.db whose first bytes are something else is not a THUMBSDB file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the THUMBSDB guide explains what a genuine file should contain.