Greetings All,
I'm working on a case involving the use of eMule and I need to locate (if possible) the installation GUID on the suspect machine. So far I have not had much luck in locating it and am reaching out to you folks for some guidance on where this information is stored.
Thanks in advance!
Not sure about eMule specifically, but try looking for a Profile.xml file
On Windows XP (old system I just processed), the profile file for Shareaza was at
~\Documents and Settings\<userAccount>\Application Data\Shareaza\Data\Profile.xml
This file contains both the Gnutella and BitTorrent GUID.
With Shareaza, the GUID can be re-generated at any time by the user, so you may have to look at deleted artifacts to find old GUIDs on the system.
A good PDF on P2P is
http//