I've been reading about .dat files which hold data for LimeWire.
I was wondering if anyone knows of a complete (or near complete) list of other .dat files (or similar) associated with other p2p applications, or if there even are any?
If there isn't a complete list out there does anyone want to contribute and start a list here?
Note that .dat is a very common extension; probably to indicate application specific data.
So if you want to create such a list include the filenames as well.
Yes, apologies joachimm, that's exactly what I meant perhaps along with the common path to the .dat file.
Although some further investigation yesterday turned up these files associated with P2P applications which may be of use to start us off….
LimeWire - Library.dat (location unknown at this moment in time)
Kazaa - Various data****.dbb files, again location unknown)
Shareaza - libray*.dat files (location unknown)
Obviously I was wrong in assuming they were all .dat files as the Kazaa database files show.
Some Skype ones…..
In C\documents and settings\skype\application data\[username]
chatmember256.dbb
chat512.dbb
chatmsg256.dbb
call256.dbb
tranfer512.dbb
NOTE - Some are encrypted
fileurns.cache
limewire.props
Both limewire.
fileurns.cache
limewire.propsBoth limewire.
fileurns.cache seems to be very useful, good post Xennith.
downloads.dat; keeps a record of LimeWire downloads that are pending, on closure of the application. Older versions may possibly store search terms that were used to locate the files on the Gnutella network.
library5.dat; I think this one shows up in LimeWire v5+ (hence the name) and is similar in function to the library.dat, but may contain more detailed information.
I also think that the createtimes.cache file (LimeWire again) may be significant. Some initial testing seems to indicate that this might be a better source for determining whether files are currently being shared. While fileurns.cache does indicate files that have been shared via LimeWire, it is possible for a file to stop being shared but remain listed in this file - the files listed in createtimes.cache seem to reflect just the currently shared content. I was only able to conduct limited testing of this file, so this is by no means a conclusive statement …
PhilH
I've also read that Kazaa and Skype files are in practically the same format which is quite interesting.
fileurns.cache
limewire.propsBoth limewire.
fileurns.cache seems to be very useful, good post Xennith.
If you're UK law enforcement, drop me a PM and I'll give you the enscript I've written to parse it and the paper I wrote on the reverse engineering process.
I've also read that Kazaa and Skype files are in practically the same format which is quite interesting.
If I'm not mistaken both applications originate from the same company/organisation.
