recovery of search inquiry

I am interested in knowing whether the search criteria specified in a P2P program is stored so that is can be recovered forensically even after the P2P has been removed?

Thanks

Legaleagle

Yes it can be, there are even P2P specific tools out there.

I think that would depend on the particular P2P app you were referring to…some may maintain the search queries in an MRUList the way MS does, some may not.

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com