I am analyzing a variety of Limewire configuration files. I have opened and processed the downloads.dat file. Its not an easy read. Does anybody know where keywords and search terms were stored within this file? Is there a variable or header similar to those found in the limewire.props file?
Also, while some data is in plain text, others (probably the most important) are encoded. Is there a program other than Ascan that can read this file.
Thanks
PenrodEllis Forensic Data Discoverydpenrod@penrodellisfdd.com
If you search this forum you will find a variety of information as well as two white papers form Science Direct that are extremely helpful.
David,
I have written some software that should be able to help you in your problems. I was working on a Downloads.dat parser but parked it because of other projects, but I have sent a beta for you to test. On my site there is a FileUrns reader, Props reader and Library v4 and v5 parser. If you have found gnutella artefacts in the UC, just copy out as much as you can from the ACED header forwards to the EOF as a binary dump, then use one of the tools to interpret the data.
http//
Allan S Hay
David,
Great to see you on here. See you tomorrow around the normal time.