What is a thumbnail or media preview?¶

A messaging application may show a small image or preview even when the original media file is unavailable.

Evidential caution: that the preview is the complete original file.

What this means¶

A thumbnail is a reduced or altered representation created to display media quickly. A preview may be generated from an image, video, document, link or attachment.

The application may store the preview separately from the original file.

That means a thumbnail can survive after the original media is deleted, moved or no longer accessible.

It can help show that particular content was presented or processed by the application. It may also help identify the likely subject of missing media.

But a thumbnail is not necessarily identical to the original. It may be cropped, compressed, resized or generated from only one frame or page.

Its metadata may relate to the preview’s creation rather than to the original file.

In reports, identify the recovered item accurately as a thumbnail or preview rather than presenting it as the original attachment.

What to check or do next¶

• Preserve the thumbnail, its file path, dimensions, associated message or attachment identifier and the device or application from which it came.
• Look for the original in downloads, galleries, caches, backups, linked devices, recipient devices and cloud storage.
• Do not infer that a person viewed the full media merely because a preview exists. Preview generation may be automatic.