Notifications
Clear all

Bit Torrents

4 Posts
2 Users
0 Likes
1,765 Views
pajkow
(@pajkow)
Posts: 81
Estimable Member
Topic starter
 

Hi All,

I am carrying out detailed analysis of uTorrent and I was wondering whether any of folks here have done it and how

My objectives are

1 To establish the list of all torrent files that were downloaded onto the machine; the machine has uTorrent software installed. I’ve got some torrent files on the HDD so I would assume that most of them were opened in uTorrent application and files were downloaded/uploaded but what about deleted in unallocated space?

So I wonder whether there is log containing all torrent files that were downloaded/uploaded in detail who downloaded how much? IP addresses, something similar to known.met in e-mule ?

2 Will resume.dat contain this information, if yes, will it contain list of all files that were removed from uTorrent library?

3 Any up to date parser/bencode reader for resume.dat?

At the moment I am relying only on EnCase 7 Enscripts (BenCode File Finder v3.6.0) and Viewer v1.1.0) I would like to verify what does those scripts pull out and learn more about detailed structure of Torrent files, any other artefacts that may be useful for us.

 
Posted : 06/10/2016 4:36 pm
(@hommy0)
Posts: 98
Trusted Member
 

The resume.dat and the torrent file itself are bencoded. The enscript you mention decodes the bencoded dictionaries that form the structure of the both the resume.dat and the torrent.

The bencoded format can be found on www.bittorrent.org/beeps/bep_0003.html

The resume.dat may contain references to torrents, also you may be able to recover deleted resume.dat files from the unallocated clusters. I understand the enscript you mention has the ability to target the unallocated clusters to identify deleted bencoded files (such as the resume.dat)

The BitTorrent Bencoded File Finder enscript is currently in version 3.6.1.

 
Posted : 18/10/2016 12:39 pm
pajkow
(@pajkow)
Posts: 81
Estimable Member
Topic starter
 

hommy0

Thanks for your reply, but the following link does not work.

roll

 
Posted : 18/10/2016 2:29 pm
(@hommy0)
Posts: 98
Trusted Member
 

Sorry, try this one

http//www.bittorrent.org/beps/bep_0003.html

 
Posted : 18/10/2016 2:39 pm
Share: