:: Training

:: Mailing List
News and updates:

Subscribe here

:: Contact

Contact Us

Email: info@filesig.co.uk

Post: Filesig Software,
PO Box 678,
YO26 0FU

Windows Photo Gallery Primer - Pictures.pd4

This article covers the program Windows Photo Gallery and analysis of data file typically titled pictures.pd4 file and how to extract the content for review. Windows Photo Gallery (WPG) is a multimedia management tool developed by Microsoft and comes installed as part of the Microsoft Windows Vista operating system. It is accessible from the Start menu under 'Programs'.

WPG allows you to batch preview photo and video content as a series of thumbnails serving as an electronic photo album. A user can add additional information or 'tags' to each entry including comments, ratings and other descriptive information.

Windows Photo Gallery Pictures.pd4

The above picture shows WPG running and previewing both video and picture files. New files are added from the menu option 'Add Folder to Gallery'. Files can be previewed by tag, date or by rating, views can be filtered to show only picture, video or both.

The information generated when a user has previewed files using WPG is written to disk in a single file, this is typically titled 'pictures.pd4', one file exists for each profile on the computer in the following location:

VOLUME\Users\PROFILE\AppData\Local\Microsoft\Windows Photo Gallery

The WPG data file can be readily examined using the tool WPG Viewer a forensic software tool which is part of the Simple Carver Suite and is capable of reading the 'pictures.pd4' file.

Windows Photo Gallery Viewer

The WPG data (picture.pd4) file contains a wealth of information including but not limited to File Path information, file properties, source label (hard disk drive label), source serial (volume serial number), user rating information, tag information, comments and descriptions and thumbnail moniker.

Click here for WPG Viewer for pictures.pd4