TThis EnScript searches for bookmarks and decodes GigaTribe V3 download state information.
Use of the script would be beneficial when investigating a group of users who are using GigaTribe to share files of an illicit nature.
This data is to be found within a file with the same name of file being downloaded but with the added file-extension of '.downloading.state'.
The download-state information contains the GigaTribe URL of the file being dowloaded (including the user-name of the user sharing the file) the size of the file its last-written date the password needed to access the file (if a password was set at a parent folder level) the download state (paused or active) and the download-extent data (usually only present if the download is current and some data has already been downloaded).
The script also reads what appears to be a 4-byte checksum (hash) which may sometimes be null. The algorithm used to create this hash is not known.
Progress may be monitored via the console.
The script produces a tab-delimited spreadsheet file as well as bookmarks.
This script was developed for use in EnCase training. For more details, please click the following link:
733 items
1 item
211 item
169 item
9 item
235 item
11 item
13 item
88 item