Notifications
Clear all

Frostwire Artifacts

2 Posts
2 Users
0 Likes
1,023 Views
(@renfantino)
Posts: 9
Active Member
Topic starter
 

Does anyone have experience with artifacts related to Frostwire v6? The suspect had uninstalled Frostwire, however there were still two H2 DB files present, "crawldb.mv" and "library_db.mv". The DB "crawldb.mv" contains one table named "CACHEDATA". Axiom marked the data in this database as “torrent fragments”. After reviewing the data I suspect this database contains the cache results from user searches, and does not contain the user's actual searches. Can anyone confirm this?

Thanks,

Ryan

 
Posted : 26/09/2019 7:00 pm
(@athulin)
Posts: 1156
Noble Member
 

The DB "crawldb.mv" contains one table named "CACHEDATA". Axiom marked the data in this database as “torrent fragments”. After reviewing the data I suspect this database contains the cache results from user searches, and does not contain the user's actual searches. Can anyone confirm this?

The source is available on line (SourceForge). The table CacheData appears only once, in the file ./desktop/src/com/frostwire/search/CrawlCacheDB.java. The source (at least the source I got) confirms that h2 is the database in use, even though many of the variables etc have names containing 'SQLite'. (You don't say what platform is used. I seem to be looking at Android code, but you just may have something else.)

As far as I can see, it's used only by the code in DatabaseCrawlCache.java, which in turn seems to be used only by ./desktop/src/com/limegroup/gnutella/gui/search/SearchMediator.java.

I've not got very deeply in the code, but if variable and methods names are anything to go by, this may have something to with searches started from the user interface. But of course, we don't go by impressions or guesses, do we?

It would probably be necessary to load this into an IDE, set suitable breakpoints or watches, and see exactly when the relevant calls in CrawlCacheDb or SearchMediator are hit, and so figure out why. My guess half a day's work, if you already have the appropriate development environment set up, and know what you are doing.

 
Posted : 27/09/2019 6:28 am
Share: