Windows Thumbcache

A subject deletes a file or files to prevent them from being available for later analysis or to disrupt the availability of a system. This could include log files, files downloaded by the subject, files created by the subject, or system files.

The subject uses a USB cable, and any relevant software if required, to transfer files or data from one system to a mobile device. This device is then taken outside of the organization's control, where the subject can later access the contents.

The subject browses, searches, or navigates files stored on a local system to identify data of interest. This includes interaction with files located on endpoint storage such as workstation drives, cached directories, synchronized folders (e.g., cloud sync clients), or application-specific storage locations.

Local file exploration may involve directory traversal, use of operating system search functions, sorting or filtering file views, and opening or previewing files without immediate transfer. In many environments, locally stored data includes synchronized copies of cloud repositories, downloaded attachments, or cached sensitive information, making it a viable source for discovery activity prior to exfiltration.