A Methodology and Tool for Investigation of Artifacts Left by the BitTorrent Client

Symmetry

Kęstutis Paulikas¹  Algimantas Venčkauskas²  Jevgenijus Toldinas²  Vacius Jusas³ 

[1] Applied Informatics Department, Kaunas University of Technology, Studentu St. 50, Kaunas LT-51368, Lithuania;Computer Department, Kaunas University of Technology, Studentu St. 50, Kaunas LT-51368, Lithuania;Software Engineering Department, Kaunas University of Technology, Studentu St. 50, Kaunas LT-51368, Lithuania;

关键词: BitTorrent protocol;    forensics investigation;    XML format;    cybercrime;   

DOI  :  10.3390/sym8060040

来源: DOAJ

【 摘 要 】

The BitTorrent client application is a popular utility for sharing large files over the Internet. Sometimes, this powerful utility is used to commit cybercrimes, like sharing of illegal material or illegal sharing of legal material. In order to help forensics investigators to fight against these cybercrimes, we carried out an investigation of the artifacts left by the BitTorrent client. We proposed a methodology to locate the artifacts that indicate the BitTorrent client activity performed. Additionally, we designed and implemented a tool that searches for the evidence left by the BitTorrent client application in a local computer running Windows. The tool looks for the four files holding the evidence. The files are as follows: *.torrent, dht.dat, resume.dat, and settings.dat. The tool decodes the files, extracts important information for the forensic investigator and converts it into XML format. The results are combined into a single result file.

【 授权许可】

Unknown