Shareaza

This was done on Shareaza version 2.2.5.0 so i hope it will be of some help.

It is partially concluded research that has yet to be completed but I have done the bit on searching.

To conduct a search on Shareaza a user has first to activate the software and connect to the network.

Search box is required to be activated and a user has then to enter a search term. By default all files are selected to be searched but a user can elect to narrow this search down to specific types of files such as Document, Software, movie, audio and image.

Once a search term is entered and the search button clicked search results are displayed on the right hand side of the screen for the user.

First search carried out in software was at 00.55 on 14/09/2007. This search term was “John Wayne” and all files was selected.

At 00.59 hours this search had returned no hits so search was stopped by selecting “stop search” button.

New search using “Abba” as search term on any file type was selected. This returned three hits and the search was stopped by selecting the stop search button. The search tab however was left active and not deleted.

Shareaza was then closed and the computer was then closed down and imaged.

Examination of the drive revealed the following file of interest

Docs and Settings\Username\ApplicationData\Shareaza\Dat\Searches.dat

This file contained the following data

•••••••••••••••••0x¶•C©<©ŽfõæD•øÿþÿ

•••••••••••••••••ÿþÿ•••••••••••••••••••••••••••••••••••••••••••••••••••••n³{¶•C©<“ü¦ÚÞT)ÿþÿ•

•••••••••••••••••ÿþÿ•••••••••••••••••••••••••••••••••••••••••••••ÿþÿ•••••ÿþÿ•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••ÿÿÿÿ••¬ô-•••••ÿþÿ•5•0•.•8•7• •M•B•••••ê•Mó®»íºÒY£?Ë-»˜%ŒM••••••••••••••••••••œ•••ÿþÿ•8•3• •K•B•/•s•••••••••••••••••••••n³{¶•C©<“ü¦ÚÞT)••••Ï~º¦íkN€<UF•pqWÔ{‘+¦Fœ•••ÿþÿ•8•3• •K•B•/•s•ÿþÿ•M•R•P•H•••••••••••••••••••••••••••••••••••••ê•Mó®»íºÒY£?Ë-»˜%ŒM••••••••ÿþÿQh•t•t•p••/•/•2•1•2•.•1•2•3•.•1•4•5•.•4•3••1•8•0•8•6•/•u•r•i•-•r•e•s•/•N•2•R•?•u•r•n••s•h•a•1••P•7•V•A•W•T•P•T•V•2•5•6•3•O•W•S•L•G•R•T•7•S•Z•N•X•O•M•C•L•D•C•N•ÿþÿ&K•a•r•a•o•k•e• •-• •A•B•B•A• •-• •G•i•m•m•e• •G•i•m•m•e• •G•i•m•m•e•.•m•p•g•••••••••¬ô-•••••••••••••••••ÿþÿ•••••ÿþÿ•ÿþÿ•••••ÿþÿ•••••••••••••••••T«••••••ÿþÿ•4•9•.•5•4• •M•B•••••«•ïï•}ÓÇŒ•08”ÔÈ#•G¼••••••••••••••••••••œ•••ÿþÿ•8•3• •K•B•/•s•••••••••••••••••••••n³{¶•C©<“ü¦ÚÞT)••••Ï~º¦íkN€<UF•pqWÔ{‘+¦Fœ•••ÿþÿ•8•3• •K•B•/•s•ÿþÿ•M•R•P•H•••••••••••••••••••••••••••••••••••••«•ïï•}ÓÇŒ•08”ÔÈ#•G¼••••••••ÿþÿQh•t•t•p••/•/•2•1•2•.•1•2•3•.•1•4•5•.•4•3••1•8•0•8•6•/•u•r•i•-•r•e•s•/•N•2•R•?•u•r•n••s•h•a•1••V•M•A•6•7•3•6•C•B•N•6•5•H•R•4•M•C•M•Y•D•R•F•G•U•Z•A•R•R•O•R•5•4•ÿþÿ3K•a•r•a•o•k•e• •-• •A•B•B•A• •-• •T•h•e• •W•i•n•n•e•r• •T•a•k•e•s• •I•t• •A•l•l• •V•i•d•e•o•.•m•p•e•g•••••••••T«••••••••••••••••••ÿþÿ•••••ÿþÿ•ÿþÿ•••••ÿþÿ•••••••••••••••••ü“ç•••••ÿþÿ•4•6•.•4•7• •M•B•••••Ÿ{±¢u•¤•uKÔÜôju4ÿVÆ-••••••••••••••••••••œ•••ÿþÿ•8•3• •K•B•/•s•••••••••••••••••••••n³{¶•C©<“ü¦ÚÞT)••••Ï~º¦íkN€<UF•pqWÔ{‘+¦Fœ•••ÿþÿ•8•3• •K•B•/•s•ÿþÿ•M•R•P•H•••••••••••••••••••••••••••••••••••••Ÿ{±¢u•¤•uKÔÜôju4ÿVÆ-••••••••ÿþÿQh•t•t•p••/•/•2•1•2•.•1•2•3•.•1•4•5•.•4•3••1•8•0•8•6•/•u•r•i•-•r•e•s•/•N•2•R•?•u•r•n••s•h•a•1••T•5•5•3•D•I•T•V•D•K•S•A•O•5•K•L•2•T•O•P•I•2•T•V•G•T•7•V•N•R•R•N•ÿþÿ•K•a•r•a•o•k•e• •-• •A•b•b•a• •-• •F•e•r•n•a•n•d•o•.•m•p•g•••••••••ü“ç•••••••••••••••••ÿþÿ•••••ÿþÿ•ÿþÿ•••••ÿþÿ•••••••••••••••••••v•••••ÿþÿ•3•9•.•3•8• •M•B•••••ý¦gì•„•??¿+ó>°2À`Ô¦ô••••••••••••••••••••••••ÿþÿ•••••••••••••••••••••n³{¶•C©<“ü¦ÚÞT)••••Ï~º¦íkN€<UF•pqWÔ{‘+¦Fœ•••ÿþÿ•ÿþÿ•M•R•P•H•••••••••••••••••••••••••••••••••••••ý¦gì•„•??¿+ó>°2À`Ô¦ô••••••••ÿþÿQh•t•t•p••/•/•2•1•2•.•1•2•3•.•1•4•5•.•4•3••1•8•0•8•6•/•u•r•i•-•r•e•s•/•N•2•R•?•u•r•n••s•h•a•1••7•W•T•G•P•3•A•P•Q•Q•C•T•6•P•5•7•F•P•Z•T•5•M•B•S•Y•B•Q•N•J•J•X•U•ÿþÿ>A•B•B•A• •-• •D•a•n•c•i•n•g• •Q•u•e•e•n• •(•O•r•i•g•i•n•a•l•)•(•0•6•-•1•8•-•1•9•7•6•)•(•K•A•R•A•O•K•E• •V•I•D•E•O•)•.•m•p•g•••••••••••v•••••••••••••••••ÿþÿ•••••ÿþÿ•ÿþÿ•••••ÿþÿ•••••••••••••••••••

As can be seen the two search terms used have been recorded in this file. This includes the search term “John Wayne” where no results were returned prior to the search being stopped.

It should be noted that the file names shown under the “abba” search term are only those files that were returned as search results and available for download and do not relate to any files actually downloaded by the user.

I have not as yet had time to figure out a header for the searches.dat file to do a search in unallocated but it should be fairly straight forward if you run a search yourself and look at the file. I did note however that the search terms appear first in the file, in order if the tabs are still active with the search results appearing next, again in order of the searches I made.

Further experiments revealed that if a search tab in Shareaza was closed (deleted) then when the drive was examined the searches.dat file was not present at its normal location.

It therefore seems that data found in a searches.dat file is good evidence the search was still active on the software or at least still available to be continued by the computer user without the details being re entered.

Using the search term John Wayne and abba did however recover the file from unallocated clusters ( I used Encase but I suppose any will do it).

It must be reiterated that the search hits returned did not always correspond in anyway to the search term put in and the data shown in the searches.dat file were the results of the search not files that were downloaded ( A subsequent John Wayne search term brought up pornographic results!!!!!!!!).

When I stopped a search the software asks if you wish to keep the results. If you elect yes then the search hits are shown in the searches.dat file until the seach tab is closed. If you elect not to keep the results then they are not included in the searches.dat file but the search term was retained until the tab was closed.

It was also noted that if a specific type of file was selected, ie doc audio video etc then this was also indicated in the searches.dat file. If all file types was selected this to was shown. Am still in process of writing up this bit of research as and when I get the time.

Not a lot but it may be of help, especiall if you figure out the header for the searches.dat file to search unallocated.