I found an artifact that shows Frostwire/Saved/ had a subfolder, lets just call it 'test'.
Would I be correct in saying that the user created this 'test' subfolder? Is there anyway to download a folder via Frostwire?
I do not believe this was a zip file. I have file references in which the file was (time indeterminate) in \Frostwire\Saved, and then (time indeterminate) \Frostwire\Saved\test.
I suspect user interaction (creating the folder and moving files of interest), and would like to prove/disprove it.
If the filesystem is NTFS you can look at the $MFT Entry for information regarding timestamps such as the MFT MOD date for that entry. Other than that in my own research I have not seen additional folders created unless they were zip files that were extracted to that directory.
Thank you for replying.
I do not have an MFT entry for the subfolders, just paths found in unallocated space, link files, etc.