Vee
FrostWire Version b5
[root]User/xxx/FrostWire
This folder contains five subfolders that contain the actual .torrent files and the actual media that has been downloaded. The subfolders contained within the abovementioned folder are:
•Incomplete: Within this folder, the temporary tracker of the media is saved while in the process of being downloaded, this is the metaphorical bookmark that enables the software to stop and start as the user wishes.
•Saved: This folder contains the artifacts of .torrent files that the user wishes to save- to be able to download at another time.
•Shared: This folder contains all the .torrent trackers that the user has uploaded or created. FrostWirev.5 enables the creation of .torrent trackers.
•Torrent Data: Possibly one of the most important folders, this is where the software saves the actual downloaded media.This is a system automated process, which remains standard.
•Torrent: This folder contains the actual .torrent tracker file, which is the tracker and that is created to download the requested item. For each item downloaded, two entries are created -A .torrent file is created that contain the creation time, the SHA 1 value of the downloaded item, and from where it was downloaded. The second entry created is in unallocated space, which contains the exact same information.
[root]user/xxx/AppData/Roaming/FrostWire
This folder essentially contains a few very important artifacts, which contain important evidentiary information on what was downloaded.
•Createtimes.cache: This cache file contains the SHA-1 value that is assigned to all uploaded media when a .torrent file is created and uploaded to the distribution websites. The SHA-1 value is that of the whole file when it was originally uploaded.This is verified once the item has been downloaded to ensure that the right and complete item has been downloaded.
•Download.dat: This database file contains all the names, identification SHA-1 values of all the files and media downloaded by the user using FrostWire v.5. This can be used to identify what was downloaded when the actual physical items are no longer on the machine.
•Fileurns.cache & Fileurns.bak: These two files essentially contain the same information. When a download is started the software logs the SHA-1 value of the file to ensure that the completed file is downloaded. The SHA-1 value can be used to identify whether a certain item matched the online version of the said file.
•FrostWire.props: This property file contains the selection made by the user upon installation. Here you can determine what changes have been made to the default settings of FrostWire v.5.
•Hostiles.txt: This contains a log of all subnet Masks currently running on the FrostWire v.5 network.
•Library.dat: This database is of all media that is saved by the user to the FrostWire v.5 library, even if it was not physically downloaded onto the machine.
Identifying Searches Done Using FrostWire v.5:
When a user searches for a specific item to download, that search is stored in various places on the local machine:
1.[root]/$Logfile: Contains the search term searched for, where it was found along with the SHA-1 identification hash value.
2.[root]/ProgramData/Microsoft/Search/Data/Applications/Windows/GatherLogs/SystemIndex/SystemIndex.gthr: The header information contained within this gather log, is the search term and how the system and the software communicated.This information is gathered by the two tracing protocols mentioned early Rasapi 32 and RASMANCS.
3.[root]users/xxx/.FrostWire/search_db.h2.db :This is the database that FrostWire v.5 uses to record all searches done by the users.The information recorded is the following:
i. URL Details, where the .torrent file is residing.
ii. The search term searched.
iii. The magnet link and corresponding SHA-1 hash value.
iv. The creation date in Unix that .torrent tracker was created.
4.[root]users/xxx/.FrostWire/search_db/search_db/_28.tii: This is the actual entry in the database for each search term done by the user.This contained what the search term was and the corresponding file ID.
5.[root]users/xxx/.FrostWire/search_db_searchdb__28.tis:This is a record of the search results for the particular search term, meaning that for every .tii file a corresponding .tis file can be found.
Examining a .torrent File and the Artifacts Found:
The file header for .torrent files in hex is:
0×64 38 3A 61 6E 6E 6F 6F 63 65 35 39 (As viewed in hex)
d8:announce59 (As viewed in text)
Contained in this .torrent file is the following information:
File Meaning
http://tracker.torrentbox.com The website that the .torrent file was uploaded to and stored on
2710 The initial port used to communicate to the website initially.
77.247.176.132:80 The IP address communicated with along with the port used for downloading.
1238229350 Unix creation date of the torrent.
Linux Books The name of the item downloaded.
31C8D8C7748C9CC8090C4C2A Identification SHA-1 hash value.
The registry keys SOFTWARE, SECURITY,SYSTEM and the Ntuser.dat were examined and the following artifacts or changes were identified:
1.HKEY/LOCAL MACHINE/SOFTWARE/Current Version: (These changes can be seen in the NTUSER.DAT as well)
This contained the following relevant information of the software FrostWire v.5:
i. Display Name
ii. Publisher
iii. Help Link
iv. URL
v. URL Info
vi. Display Version
vii. Uninstall Command
2.HKEY/LOCAL MACHINE/SOFTWARE/Classes:
This contained the following relevant information of the software FrostWire v.5:
i. FrostWire Toolbar
ii. FrostWire.exe files location.
3. HKEY/LOCAL MACHINE/SOFTWARE/FrostWire:
This contained the following relevant information of the software FrostWire v.5:
i.The executable command used to access and run FrostWire v.5.
4.HKEY/LOCAL MACHINE/SOFTWARE/Tracing:
This contained the following relevant information of the software FrostWire v.5:
i.This contains two tracing mechanisms that Microsoft uses to manage and monitor software, which is the Rasapi 32 command and the RASMANCS command. The information saved is saved in [root]/ProgramData/Microsoft/Search/Data/Applications/Windows/GatherLogs/SystemIndex/SystemIndex.gthr:
5.HKEY/LOCAL MACHINE/SYSTEM:
For FrostWire v.5 to be able to function, a change has to be made within how the system operates:
i.When installing FrostWire v.5, the software automatically change the FireWall policy to create an exception to allow communication from FrostWire v.5 and the downloading servers, thus bypassing the firewall completely.
6.HKEY/LOCAL MACHINE/SECURITY:
No changes could be identified within this registry key.
[root]User/xxx/FrostWire
[root]user/xxx/AppData/Roaming/FrostWire
[root]/$Logfile
[root]/ProgramData/Microsoft/Search/Data/Applications/Windows/GatherLogs/SystemIndex/SystemIndex.gthr
[root]users/xxx/.FrostWire/search_db.h2.db
[root]users/xxx/.FrostWire/search_db/search_db/_28.tii
[root]users/xxx/.FrostWire/search_db_searchdb__28.tis
http://articles.forensicfocus.com/2012/07/19/forensic-examination-of-frostwire-version-5/
FTK
FTK Imager
Raptor
SIFT
RegRipper
http://forensicartifacts.com/wp-content/uploads/gravity_forms/3-b56c65f0d638cb782e8f437e4b2147cf/2012/07/Forensic-Examination-of-FrostWire-Version-5_VSchmitt.pdf