Hi All,
I am carrying out detailed analysis of uTorrent and I was wondering whether any of folks here have done it and how
My objectives are
1 To establish the list of all torrent files that were downloaded onto the machine; the machine has uTorrent software installed. I’ve got some torrent files on the HDD so I would assume that most of them were opened in uTorrent application and files were downloaded/uploaded but what about deleted in unallocated space?
So I wonder whether there is log containing all torrent files that were downloaded/uploaded in detail who downloaded how much? IP addresses, something similar to known.met in e-mule ?
2 Will resume.dat contain this information, if yes, will it contain list of all files that were removed from uTorrent library?
3 Any up to date parser/bencode reader for resume.dat?
At the moment I am relying only on EnCase 7 Enscripts (BenCode File Finder v3.6.0) and Viewer v1.1.0) I would like to verify what does those scripts pull out and learn more about detailed structure of Torrent files, any other artefacts that may be useful for us.
The resume.dat and the torrent file itself are bencoded. The enscript you mention decodes the bencoded dictionaries that form the structure of the both the resume.dat and the torrent.
The bencoded format can be found on
The resume.dat may contain references to torrents, also you may be able to recover deleted resume.dat files from the unallocated clusters. I understand the enscript you mention has the ability to target the unallocated clusters to identify deleted bencoded files (such as the resume.dat)
The BitTorrent Bencoded File Finder enscript is currently in version 3.6.1.
hommy0
Thanks for your reply, but the following link does not work.
roll
Sorry, try this one
http//