I am trying to find out what the settings were in a P2P program called GnutellaWire at the time the hard drive was seized. I know that the default setting for this program is set to share files with other users but I determined that you can turn the shared option off. While conducting my forensic exam, I looked at the prop and library.dat files. Does anyone know how to interpret the data in the prop and library.dat files?
I haven't searched any other forums. I searched Google but couldn't find specific information on the GuntellaWire/prop and GnutellaWire/library.dat files.
the .prop file should be plaintext if it works like other gnutella clients.
as to the .dat files and .cache files you can use AScan to decode
https://
Thank you. I will check out AScan.