I am examining a system where the user has Limewire 5.2.13 Pro installed. A text string search has resulted in numerous hits in the image.sxml3 file. Examination of it's contents reveal that it appears to be are filled with metadata extracted from all of the files that at one time were present in the users library.
There are no entries in the fileurn.cache file and the user appears to have downloaded and then moved the images from the download location of C\Documents and Settings\<username>\My Documents\LimeWire\Saved\.
A text string search on the C\Documents and Settings\<username>\My Documents\LimeWire\Saved\ file path has resulted in several hundred "hits", all of the titles of which appear to indicative of abusive images.
I haven't dealt with a limewire case for a while and my question revolves around the Sealed XML Document file in particular. Can anyone confirm its purpose and what application they used to present the contents of the file in a "friendly" manner.
Thanks
Worcesterdee
Check out this response on the limewire forum
http//
Regards,
Chris Currier
Worcesterdee
Check out this response on the limewire forum
http//
forum.limewire.org/showthread.php?t=6659 Regards,
Chris Currier
Chris,
Thanks for your reply. I had seen that post, but as the individual files detailed in the image.sxml3 file are no longer in the saved folder I'm curious what the finding of a file name means. I believe that it is likely that file details are not purged from the image.xml file when they are removed from the library but they are from the fileurn.cache file. If that makes sense.
I was wondering whether anyone had done any research into the forensic artefacts associated with Limewire 5.2.13 Pro.
Cheers