Investigating Android uTorrent Application
20/01/2023 Friday
uTorrent for Android is a mobile version of the popular uTorrent desktop application that allows users to download and share files on their Android devices. It is a P2P file-sharing program that utilizes the BitTorrent protocol to download files over the internet.
Digital Forensics Value of Android uTorrent Application
The forensic significance of uTorrent artifacts lay in its ability to supply investigators with valiable information in cases of illegal or copyrighted material distribution. One of the major forensic benefits of uTorrent artifacts is the capability to examine and reveal details of the content and source of files that have been downloaded and shared through the application.
Location and Structure of Android uTorrent Application Artifacts
uTorrent artifacts are found in the following location:
data/com.utorrent.client/databases/torrent.db
Analyzing Android uTorrent with ArtiFast
This section will discuss how to use ArtiFast to extract uTorrent from Android and what kind of digital forensics insight we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android uTorrent artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android uTorrent artifacts in ArtiFast.
Android uTorrent Files
- File Name - The name of the file opened.
- File Extension - The extension of the file opened.
- Backup File Path - If the file has an automatic backup (if it has been edited and not saved).
- Language - The programming language used to write the file.
- User Read Only - Indicates whether the user has the permission to edit the file or not.
- Modification Date - The modification date and time.
Android uTorrent URLs Artifact
- Torrent File Hash Value - The hash value of the torrent file.
- Torrent File URL - The URL of the torrent file.
- Local Root - The directory on the device where the file was saved.
- Torrent File Name - The torrent file name.
- Local Path - The local path of the file.
- Is Paused - Indicates whether the download process was paused.
- Is Paused and Resume - Indicates whether the download process was paused and later resumed.
- URL Rate - The URL rate of the torrent file.
- Contained File Size - The contained file size.
- Torrent File Size - The size of the torrent file itself.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
