Windows 11 Thumbnail Cache: Deleted Photo Privacy Facts, Cleanup and Disable Guide

The difference matters. Some users are now deleting things they don't understand, while others shrug off a real privacy issue on shared PCs. Here is what the thumbnail cache does, what it doesn't do, and how to clear it or turn it off on each edition of Windows 11.

The post that started it​

Pasquale Pillitteri's report says that on September 26, 2026, at 2:38 p.m., the account @Ayzacoder wrote on X that Windows keeps a thumbnail of every photo you ever deleted, that the file is called thumbcache_256.db, that forensic examiners extract it as a matter of routine, and that 15 more like it exist. The post passed 1.7 million views. A Thread Reader copy of the thread goes further. It claims that if you download a photo and delete it five minutes later, the thumbnail stays behind.

Pillitteri notes that the visible post never lists the "15 more stores." That part can't be checked, so this article doesn't try.

Headlines split. MakeUseOf ran the story under the absolute claim that Windows has been keeping thumbnails of all your deleted photos for years. Windows Report went the other way and said plainly that Windows does not keep a thumbnail of every photo you have ever deleted. The evidence supports Windows Report.

Summary: The mechanism is real. The "every photo" framing is the exaggeration.

How the thumbnail cache works​

Microsoft's developer documentation for the IThumbnailCache interface explains the design. Windows XP kept thumbnails in a hidden Thumbs.db file inside each folder. That approach couldn't handle previews and queries across folders, so Windows Vista replaced it with one global cache shared by all applications.

The most useful detail in Microsoft's documentation is this: an application asks the cache for a thumbnail, and only if none is cached does Windows extract one from the source file with the registered thumbnail provider and store it. As BetaNews summarizes, when File Explorer or another app asks for a thumbnail that is not already cached, Windows extracts one from the source file and stores it, unless the app specifies the WTS_EXTRACTDONOTCACHE flag. The stored copy sits apart from the photo file.

That separation is why deleting a photo doesn't delete its preview. It is also why the "every photo" claim fails. A cache entry exists only after some component asks for a thumbnail. A file that was downloaded, copied or opened in a viewer, but never shown as a thumbnail, may leave nothing behind.

The databases live in each user's profile. Per Windows Latest, press Windows + R, paste %LOCALAPPDATA%\Microsoft\Windows\Explorer and hit Enter. You'll see database files like thumbcache_32.db, thumbcache_96.db, thumbcache_256.db and thumbcache_1024.db. Each of these have previews of a different size, and the set varies between Windows versions. BetaNews adds that the cache also holds previews of videos and certain documents, not only photos.

Opening that folder won't show you your old pictures. Opening this folder won't show you a gallery of deleted photos, by the way. You'd need a tool like the open-source Thumbcache Viewer to pull images out of these databases.

Summary: Thumbnails are made when something asks for them, stored separately from the originals, and kept per user.

The test that deflates the claim​

Windows Latest tried to reproduce the claim. Its reporter wrote: "At 4:01, I downloaded three images, opened them, deleted them and checked the folder. The thumbcache files were there (of course), but their last modified date was September 17 instead of September 28, which means nothing new was written to them." "I used the PC for a while, restarted it and checked again. Still no change."

The images were opened without being browsed in a thumbnail view. The outlet says that may be why nothing was cached. Windows Latest also cites Microsoft engineer Raymond Chen's 2016 explanation that simply creating or copying image files doesn't create cache entries. Entries come from Explorer, or another app that uses Explorer's cache, actually displaying a thumbnail.

Two caveats:

• BetaNews is not a second test. It summarized the same Windows Latest test, so it confirms the account, not the result.
• One test proves only what it tested. It shows that "download, open, delete" doesn't automatically write a thumbnail. It says nothing about photos you browsed in Large icons view for years. Those are exactly the ones likely to be sitting in the cache.

Summary: Downloading a file isn't enough. Viewing it as a thumbnail is what usually leaves a trace.

Forensic value is real, within limits​

This is not new knowledge in forensics. Forensic examiners use tools such as Thumbcache Viewer, an open-source utility, to extract images from the cache databases after the source files are gone. The project's own site says it reads thumbcache and iconcache databases from Windows Vista through Windows 11. The graphical version is 1.0.4.0, released October 25, 2023, and a command-line version (1.0.2.1) can produce CSV and HTML reports. Pillitteri also cites analysis by Pen Test Partners describing the technique. That piece wasn't independently checked for this article.

What an examiner gets back is a preview, not the photo. The tool retrieves thumbnails only, and how much a preview of that size reveals about a person or place depends on the image. A 1024-pixel entry can be very revealing. A 32-pixel icon may show little more than a blob of color.

A surviving thumbnail shows that a preview was generated at some point. On its own it doesn't prove who looked at the file or when it was deleted.

Summary: Useful to investigators, but it's a trace, not a copy of the original.

Microsoft's own advice​

This isn't a vulnerability. Microsoft documents the behavior and ships a switch for it. On Microsoft Learn, the ADMX_WindowsExplorer policy CSP describes Turn off caching of thumbnail pictures (NoCacheThumbNailPictures):

• It is a user-scope policy.
• It is listed for Windows 11 from version 21H2 on the Pro, Enterprise, Education and IoT Enterprise editions.
• Its registry mapping is the NoThumbnailCache value under Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.

Microsoft's documentation for the policy Turn off caching of thumbnail pictures recommends turning it on for shared corporate workstations and computers where security is a top concern, because "the thumbnail cache can be read by everyone."

For admins managing fleets through Intune or Group Policy, that is the lever to use. The registry path is there for reference. It's not an invitation to hand-edit the registry on every machine.

How to clear the cache and stop new entries​

None of these steps deletes your photos. You only lose preview speed until Windows rebuilds the cache.

1. Clear existing thumbnails with Disk Cleanup (all editions)​

1. Press Windows + R, type cleanmgr and press Enter.
2. Select your Windows drive, usually C:, and click OK.
3. Tick Thumbnails, click OK, then click Delete Files.

Windows Latest points out that you don't need to tick Temporary files, whatever the viral post says. Windows rebuilds the cache as folders are browsed. That's normal behavior, not a sign the cleanup failed.

2. Stop caching on Pro, Enterprise and Education​

1. Run gpedit.msc.
2. Go to User Configuration > Administrative Templates > Windows Components > File Explorer.
3. Enable Turn off caching of thumbnail pictures.

Turning the policy on doesn't erase entries that already exist, so run Disk Cleanup as well. The Thumbcache Viewer documentation also says that with only this policy set, thumbnails are still generated and shown but never saved. Folders full of images will load more slowly as a result. The same policy area has settings to show icons instead of thumbnails if you'd rather have speed than previews.

3. The Windows 11 Home workaround​

Home doesn't include gpedit.msc. On Windows 11 Home, the closest option is the File Explorer setting Always show icons, never thumbnails, which stops Explorer from generating previews. You'll find it under Folder Options, on the View tab. It isn't a full substitute for the policy, because it controls File Explorer and not every app that uses the cache. It also doesn't remove existing entries, so run Disk Cleanup too.

4. Delete the database files by hand (last resort)​

The database files can also be deleted manually from the Explorer folder after File Explorer is closed. Expect some files to be locked. The Thumbcache Viewer FAQ warns that the system usually has them open and recommends Disk Cleanup instead. Windows will recreate the files as you browse.

Summary: Disk Cleanup clears the cache. The policy, or the Home setting, stops it filling up again.

Should you worry?​

It depends on who can get at your user profile. On a single-user PC with BitLocker or device encryption, the risk is low. Anyone who can already read your profile can probably read your actual photos too. Be more careful in these cases:

• shared family or office computers
• laptops sent in for repair
• drives sold or passed on without a proper wipe

Windows Latest makes a fair point: this isn't only a Windows habit. macOS, Linux desktops and Android all cache image thumbnails, because scrolling through thousands of photos would be slow if every preview had to be rebuilt each time. The broader lesson is that deleting a file doesn't remove every trace of it.

Bottom line​

The @Ayzacoder post is right about how the cache works and wrong about how far it reaches. Windows 11 doesn't keep a secret archive of every photo you've deleted. It does keep the previews File Explorer has already shown you, and those can outlast the originals.

• If you deleted something sensitive, run Disk Cleanup and clear Thumbnails.
• On shared or managed machines, follow Microsoft's advice and enable the thumbnail caching policy.