Investigating qBittorrent
02/06/2023 Friday
In contrast to the traditional downloading methods, BitTorrent protocol-based applications allow users to download large files from the internet easily. The main idea behind this protocol is to divide the large files into smaller pieces and distribute these pieces of data in different locations on the network. When a user tries to download a large file, the parts of this file are going to be downloaded simultaneously from different resources which allows for a more stable downloading process. qBittorrent is a free and open-source BitTorrent application developed by volunteer programmers to support multiple Operating Systems.
Digital Forensics Value of qBittorrentg
Since BitTorrent Applications are used to download large files by most of people, parsing these apps’ left-behind information will provide valuable information about the users’ activities. qBittorrent artifact stores important information about the downloaded torrents like; the file name, path, size, and downloading data/time.
Location of qBittorrent Artifacts
qBittorrent artifacts can be found at the following location:
%Systempartititon%\%Username%\AppData\Local\qBittorrent\BT_backup
Analyzing qBittorrent Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Windows qBittorrent artifacts from Windows machines and what kind of digital
forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select qBittorrent Torrents’ artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Windows qBittorrent artifacts in ArtiFast.
qBittorrent Torrents
- Trackers - The information about this torrent trackers.
- Paused - Indicates whether this torrent has been paused while the downloading process or not.
- Save Path - The path where this torrent has been saved in the file system.
- Active Time - Active Time.
- Total Downloaded - The number of downloaded data in bytes.
- Seeding Time - Seeding Time.
- Added Time - Added Time.
- Finished Time - The time when this downloading process has been finished.
- Maximum Connections - Maximum Connections.
- Download Rate Limit - Download Rate Limit.
- Completed Time - The time when this downloading process has been completed.
- Total Downloaded - The number of downloaded data in bytes.
- Total Uploaded - The number of uploaded data in bytes.
- Name - The name of the torrent.
- Files - The torrent files’ names.
- Total Size - The size of the torrent file.
- Created By - The user’s name of the torrent creator.
- Encoding - The torrent encoding method name.
- Announce - Announce.
- Announce List - Announce List.
- Torrent Creation Date - The time when this torrent has been created.
- Comment - Comment.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
