Limewire Search Ter...
 
Notifications
Clear all

Limewire Search Terms

5 Posts
4 Users
0 Likes
309 Views
(@tmy880)
Posts: 23
Eminent Member
Topic starter
 

Any way to recover or retrieve search terms from Limewire Version 5 and above using EnCase or FTK.

I know that we can do this with Limewire versions below 5!

 
Posted : 17/02/2010 9:01 am
nlpd120
(@nlpd120)
Posts: 96
Trusted Member
 

Check out JADSoftware.com for Internet Evidence Finder.

Regards,

Chris Currier

 
Posted : 20/02/2010 10:59 pm
(@minesh)
Posts: 75
Trusted Member
 

Also, bear in mind that they may change between subversions, so check the subversion first.

Minesh

 
Posted : 21/02/2010 5:34 pm
(@jimmyw)
Posts: 64
Trusted Member
 

4.16 was the last version from which search terms could be found in a reliable manner, and they came from from downloads.dat files and fragments thereof. In the more recent versions, the only places where search terms may be found are in memory and in files that capture mamory, e.g., page and hibernation. It's quite likely that searches will not get faulted to the page file, and nothing goes into hiberfil absent a system hibernation. If you use Jad's tool for LimeWire searches, aim it at the memory dump files. Portions of either file could end up in free space, but I'd be hesitant to grab a free space fragment and call it a search.

 
Posted : 02/03/2010 7:41 am
(@tmy880)
Posts: 23
Eminent Member
Topic starter
 

Thank you for the replies!!

 
Posted : 05/03/2010 9:04 am
Share: