I have several questions about Paperport PPThumbs.ptn files. I
apologize for the length of the background that follows, however, I
think the background may be helpful to you in determining the answer
to my question.
Paperport PPThumbs.ptn files are utility files created by Paperport,
which is an electronic document file management software program
marketed by ScanSoft (www.scansoft.com). My questions, which are
framed specifically below, relate to whether a forensic analysis of
the PPThumbs.ptn files created by Paperport can determine (a) whether
and (b) when Paperport documents have been deleted from the Paperport
folder to which the PPThumbs.ptn file relates.
Each Paperport folder appears to have its own PPThumbs.ptn file and
its own MaxDesk.ini file. The MaxDesk.ini file contains an ASCII
character listing of each Paperport document in the folder. You can
view the contents of the MaxDesk.ini file with the Notepad program
that is standard in Microsoft Accessory programs. If you add a
Paperport document to a folder the folder?s MaxDesk.ini file is
updated to include the new document. If you delete a Paperport
document from a folder the folder?s MaxDesk.ini file is automatically
updated to delete the reference to the deleted document. The
PPThumbs.ptn file can be opened in Notepad but the character
representation is not ASCII and is unintelligible.
When Paperport first was published all of the document files were
?.max? extension files. A few years ago, Paperport was revised so that
?.pdf? extension files can also be stored in a Paperport folder. I
have several hundred Paperport ?folders? on my computer and I have
several thousand Paperport documents. About 70% of my Paperport
folders contain only ?.max? extension files, and 100% of these folders
have a PPThumbs.ptn file that is exactly 276 bytes. Thus a Paperport
folder with 1 ?.max? file and a Paperport folder with 100 ?.max? files
will both have a PPThumbs.ptn file that is 276 bytes long. Adding or
deleting ?.max? files does not affect the number of bytes in the
associated PPThumbs.ptn file.
All of the Paperport folders that have one or more ?.pdf? extension
files in them have an associated PPThumbs.ptn file that is larger than
276 bytes, and the size of the PPThumbs.ptn folder is directly related
to the number of ?.pdf? files in the folder (and has no relation to
the number of ?.max? files in the folder, if the folder contains both
?.pdf? files and ?.max? files). For example all of my folders that
have only 1 ?.pdf? file in them have a PPThumbs.ptn file that is
exactly 9,537 bytes long regardless of whether in addition to the 1
?.pdf? file the folder also contains zero or 50 ?.max? files. Most
folders that have 2 ?.pfd? files in them have a PPThumbs.ptn file that
is 18,798 bytes long, folders that have 3 ?.pdf? files in them
normally have a PPThumbs.ptn file that is 37,320 bytes long, and so
on. Each additional pdf file in the folder increases the size of the
PPThumbs.ptn file. If a Paperport folder has 3 ?.pdf? files in it, and
you delete one of the files, the PPThumbs.ptn file is automatically
truncated by Paperport to the size of a PPThumbs.ptn file representing
a Paperport file with only 2 ?.pdf? files. If you delete all of the
?.pdf? files from a Paperport folder so that only ?.max? files remain,
then the PPThumbs.ptn file returns to just 276 bytes.
As indicated above I would like to know the extent, if any, to which a
forensic analysis of a PPThumbs.ptn file can reveal (1) whether and
(2) when there has been a deletion of one or more files from the
associated Paperport folder.
My specific questions are as follows:
1. Is a PPThumbs.ptn file always located in the same directory as the
Paperport files to which it relates?
2. What information does a PPThumbs.ptn file tell you about the
contents of the folder with which it is associated? Does it tell you
(a) how many documents are or where in the folder, (b) the date the
documents were created or deleted, and (c) the document names?
3. Would the answer to question 2 differ if the associated Paperport
folder held (a) 10 ?.max? files and no ?.pdf? files and 3 ?.max? files
that had been in the folder were deleted, or (b) 10 ?.pdf? files and
no ?.max? files and 3 ?.pdf? files that had been in the folder were
deleted?
4. Is there any way to view a PPThumbs.ptn folder to intelligently
interpret its contents? If so, what program would be used for this
purpose?
5. If I erase a ?.max? Paperport document from a folder, is the
PPThumbs.ptn file associated with the folder automatically revised so
that it no longer in any way reflects the erased file? In such case
would forensic analysis of the PPThumbs.ptn file be able to determine
whether and when ?.max? files were deleted?
6. If I erase a ?.pdf? Paperport document from a folder, is the
PPThumbs.ptn file associated with the folder automatically revised so
that it no longer in any way reflects the erased file? In such case
would forensic analysis of the PPThumbs.ptn file be able to determine
whether and when ?.pdf? files were deleted?
Paperport has a technical support number that is available on a pay
per incident basis of $19.95 407 241-1824. I have not tried to use
this number because I suspect that someone with an in-depth knowledge
of computers would be able to get a lot more out of a phone call with
the technical support people at Paperport. I will be sure to cover
your call to tech support should you so desire, because I intend to
include a $100 tip for a complete answer to these questions. If this
question requires more research time than you are able to devote to a
$200 response (with a $100 tip), please let me know how I can work out
arrangements that will allow you to devote the time required to fully
respond to the questions presented. |
