After some scratching and looking I found some new artifacts to look at and pull apart. This to me is an exciting prospect as I believe you can never ever say 100% you have found everything.
[root]user/xxxx/.frostwire/azureus/active : A copy of all active .torrent files are also saved containing all info regarding that .torrent file.
[root]user/xxxx/.frostwire/azureus/tmp : Store the last known communication, it seems that this changed with every reboot it keeps only the last communication, it store IP addresses.
[root]user/xxxx/appdata/roaming/frostwire/azureus/Active: copy of all active .torrent files are also saved containing all info regarding that .torrent file.
[root]user/xxxx/appdata/roaming/frostwire/azureus/torrent: Keeps the tracker needed to successfully download the file with.
Digital Forensics is a passion of mine, this is a blog to capture my journey in the abyss which is digital forensics along with the control alt delete moments.
No comments:
Post a Comment