> 1. If a graphics directory is displayed using thumbnails. A thumbs.db > is created within the cache and will remain there afterward. > 2. If a graphics file is displayed outright, the file will be copied > into cache and then displayed. > 3. If a video file is accessed say via Windows Media Player, the entire > file will be cached on the hard drive.
If you got a dump of memory of the running system (and it wasn't shut down after accessing the device), you may also find buffered sectors in RAM. These should be pretty easy to identify by comparing the disc's sectors against aligned blocks of memory. (At least, I believe you can make that alignment assumption, as you can in Unix systems.) HTH, tim
