Kazaa history search

Is possible to retrieve the search words kazaa. If yes, how many Mb can contain the record of history search kazaa?

A little advice. )

If you do not post some relevant info, as you were ALREADY suggested to do
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6183
like Operating system used, filesystem used etc., general context of the question, etc., the answer can be nothing but "a suffusion of yellow"
http//www.thateden.co.uk/dirk/

Additionally this sentence

Is possible to retrieve the search words kazaa.

does not make sense.

WHAT are you trying to do?
HOW do you plan to do it?
WHY do you want to do it? (which is the final goal)
WHERE are you attempting to do it?

Standard litany
http//homepages.tesco.net/J.deBoynePollard/FGA/problem-report-standard-litany.html

jaclaz

That depends. I haven't used Kazaa in years, but back when I did, I remember that search history was saved and you could view it in a dropdown search bar. That would indicate that it's saved to a file somewhere, but I'm afraid I don't know where.

Also, more info would be helpful. What version of Kazaa? What OS was it running from?

If Alex is correct with the drop down you could try using live view or other virtual machine (that will work with the target OS) to mount the image and see if you have the search drop down option.

Another technique you can do to test it is determine the version. Install it on a test machine, set it up, document some searches. Then get a RAM Dump and see if you can find the search term. Using a hex editor look at the hex/ascii before, in between, or after the search term. This may be repeatable and provide you with a hex search term to go back and search your evidence with.

Regards,

Chris Currier

Ok you are right. The operating system is Windows 98 and kazaa lite version is year 2001

http//www.pctuneuptips.com/tips/clean_history/

Kazaa is another popular peer-to-peer downloading program. We don’t usually recommend Kazaa as its files are often laced with spyware and viruses, but if you do happen to use it and want to remove its history here’s where it stores its trace files

**Important Note Kazaa stores all of its history traces and settings in Windows registry keys, so you’ll need to be very careful if you choose to edit these. Clean Kazaa registry settings and history automatically with Paretologic Privacy Controls Free History Trace Scan

Kazaa 3.x

Information about user details HKCU\Software\Kazaa\UserDetails

Recent file list HKCU\Software\Kazaa\Kazaa\Recent File List

Personal file organizer HKCU\Software\Kazaa\Kazaa\BrowserSettings

Search information HKCU\Software\Kazaa\LocalContent

Search agents HKCU\Software\Kazaa\Search

Filters HKCU\Software\Kazaa\ResultsFilter

Check also
http//www.spywaredb.com/remove-kazaa/

And
http//members.home.nl/frejon/55/ft/KazaaFileFormats.html

jaclaz

Another technique you can do to test it is determine the version. Install it on a test machine, set it up, document some searches. Then get a RAM Dump and see if you can find the search term. Using a hex editor look at the hex/ascii before, in between, or after the search term. This may be repeatable and provide you with a hex search term to go back and search your evidence with.

Regards,

Chris Currier

This wont work - that FastTrack network has been dead for a number of years now, although with A LOT of effort you may find a small functioning isolated network with enough nodes and supernodes to work - but you need a valid IP first - sort of chicken and egg.

Its years since I tried to connect and even then it was nigh on impossible.

ok now all is clear ….. Thanks