Bearflix is a peer to peer file sharing program from the Bearshare stable working on the Gnuttela network. I have examined Limewire in detail in the past and posted a lot of stuff at Forensicwiki.com.
A recent box I looked at had Bearflix installed and I found that it saves what amounts to the holy grail in these type of investigations - the user inputted search terms. The program has in built banner advertising and I found that these banner adverts cause entries to be made within Internet Explorers History index.dats. The URLs contain the search terms (presumably so that the adverts can be tailored to the search term). How cool is that! I have documented this in a couple of slides following
skip to main |
skip to sidebar
I worked at the coal face of a UK computer forensics lab and performed production line forensics - day in day out - welcome to the sausage factory
Where to find me
No longer at the sausage factory but you may find me on my bike looking for work!
My name is Richard Drinkwater. I am a freelance computer forensics consultant and welcome enquiries sent to DC1743 (at) gmail dot com
Factory Clock
Posts
Websites I go back to
Podcasts I listen to
Blog Archive
-
▼
2008
(24)
-
▼
May
(11)
- Navman iCN320 Sat Nav device
- The net widens!
- How do you tell if an account password is set in M...
- wtmp
- Tableau writeblockers and sata laptop hard drives
- Bearflix
- Google Searches
- ReadMessageLight.htm presentation
- ReadMessageLight[1].htm
- suggestqueries.google.com and search.xml
- Ramblings from the sausage factory
-
▼
May
(11)
Copyright © 2008-2014 Forensics from the sausage factory
1 comment:
Thanks for the post. I have my first BearFlix case. The configuration is much different from BearShare. One thing that I found were a few .db files, whose headers indicate they are SQLite 2.5 databases. The db files include some interesteing text, but I'm still haven't found a tool to open them properly.
Post a Comment