Examining the IconCache database
Brief
Earlier this year I came across a forensic artefact that I didn’t know a whole lot about, and there wasn’t a lot of research on either. I was working on a ransomware case where we picked up a standard KAPE triage collection. As part of that, I ran a keyword search in Xways over the entire package for the names of our malicious executables and some hits caught my eye.
Inside the users localappdata was a file called IconCache. db that I had seen in passing but never really looked at before. I had just bought a copy of 010 Editor so down the rabbit hole we go!
Special thanks to my former coworkers Cassie and Yogesh for their assistance in picking this apart.
What is IconCache
The IconCache contains the images associated with an items icon so that Windows can recall it without rebuilding it.