Any way to recover or retrieve search terms from Limewire Version 5 and above using EnCase or FTK.
I know that we can do this with Limewire versions below 5!
Check out JADSoftware.com for Internet Evidence Finder.
Regards,
Chris Currier
Also, bear in mind that they may change between subversions, so check the subversion first.
Minesh
4.16 was the last version from which search terms could be found in a reliable manner, and they came from from downloads.dat files and fragments thereof. In the more recent versions, the only places where search terms may be found are in memory and in files that capture mamory, e.g., page and hibernation. It's quite likely that searches will not get faulted to the page file, and nothing goes into hiberfil absent a system hibernation. If you use Jad's tool for LimeWire searches, aim it at the memory dump files. Portions of either file could end up in free space, but I'd be hesitant to grab a free space fragment and call it a search.
Thank you for the replies!!