Hi,
In regard to limewire, if a user previews (in limewire) a movie while it is being downloaded, are there any resulting artifacts?
I'm trying to prove a movie has been viewed, even though create date = last access within the default saved folder of limewire. The standard .lnk files expected do not exist.
Regards
What media players did the user have installed? What artefacts do they leave? Have you looked in Temp folders? What is the operating system?
Typically if a user previews a movie, within LimeWire, the software actually creates a temporary file that is then viewed by the movie player. This temporary file should be stored in the same directory as incomplete downloads, and has the prefix "Preview-" appended to the front of the filename.
So if a movie is previewed while it is being downloaded then you should have a pair of files in the incomplete files folder the incomplete downloaded file itself, and a preview file with the same name as the incomplete downloaded file but prefixed by "Preview-". Obviously LimeWire is supposed to remove these file once a file has completed downloading, but experience has shown that these are often still found on the system or indeed they may be recovered by whatever forensic software is being used.
Also older versions of LimeWire didn't have a built-in movie player (I believe the latest versions do ?), and so relied upon the system default movie player. In this case you may find registry artifacts relating to these players (e.g. recent file lists, etc.) that contain these "Preview-" filenames.
HTH )
Phil H
Also be sure to check out the users appdata for limewire I have seen it store. Preview files there aswell.
Also, can you be sure that the preview file exists on that computer because the user viewed it? Could it also be the case that the user might have (accidentally) downloaded the preview file over limewire from someone else's computer who had previewed the file?
Also, can you be sure that the preview file exists on that computer because the user viewed it? Could it also be the case that the user might have (accidentally) downloaded the preview file over limewire from someone else's computer who had previewed the file?
It's been a little while since I last looked at the LimeWire source code, but my understanding of how the "Preview" files work is as follows
When a user decides to preview a download (either before downloading, or during download), LimeWire creates a separate "Preview" file (containing a small segment of the file) within the same folder used to store incomplete downloads. By default the folder used to store incomplete downloads is not made available for sharing. Once a file has finished downloading the incomplete file, and any "Preview" file, should be deleted.
However there is an option, within LimeWire, to make incomplete downloads available for sharing. A user could also manually make a "Preview" file available for sharing, before the download completes. So yes, it is possible that a "Preview" file could have been downloaded from another user's computer but I think it's a little unlikely ?
Also, if a "Preview" file had been downloaded from another user's computer then it should be possible to determine this from the file location. If the file was downloaded from another user then the "Preview" file would be located in the folder used to store completed downloads (unless you're really unlucky and it hasn't finished downloading). Also, even if the "Preview" file itself was incomplete, you should still be able to determine this from the file naming convention used by LimeWire if the user has previewed a download on this machine, then the file will be prefixed "Preview-"; however if the user is downloading a "Preview" file from another user then the incomplete file should be prefixed "T-<size of "Preview" file in bytes>-Preview-".
Assuming we are on NTFS has the MFT record for the file got an ObjectID attribute? (40 00 00 00).
From the testing I have done I believe files get an ObjectID when they are opened and viewed, I think it is part of the process of creating a link file. If the link file no longer exists the fact that there is an ObjectID is an indicator that the file has been opened in the associated application.
I don't know how this would work with a file that has been previewed and then subsequently been allowed to complete the download, would need some testing.
H
Assuming we are on NTFS has the MFT record for the file got an ObjectID attribute? (40 00 00 00).
From the testing I have done I believe files get an ObjectID when they are opened and viewed, I think it is part of the process of creating a link file. If the link file no longer exists the fact that there is an ObjectID is an indicator that the file has been opened in the associated application.
I don't know how this would work with a file that has been previewed and then subsequently been allowed to complete the download, would need some testing.
H
I have done a bit of research on this in LimeWire 5.X
The ObjectID attribute did not get created for me when I opened any complete audio files and played them in LimeWire. Nor did they get created when I "viewed" them with Windows Media Player…the attribute did append however when I opened the audio files in iTunes…..
Just my experience with this…
cndnheat
Thanks, that is really interesting.
Just had a quick look at Limewire and I would suggest that if the file is previewed or played within the Limewire application then it will not as cndnheat suggests create a ObjectID but if opened in another associated player I believe it will do as long as a link file is created. So I am surprised that playing a video in WMP has not caused an ObjectID to be created.
However reflecting on this an ObjectID does not necessarily mean that the file has been played anyway. An ObjectID could have been allocated if the file was saved through the File Save As dialog. So cancel the ObjectID idea!!
H
