Investigating Window BitComit
13/03/2023 Monday
BitComet is a free BitTorrent client application used for downloading and sharing files over the internet. It operates on the peer-to-peer (P2P) file sharing protocol; allowing users to download large files such as movies, music, and software from other users’ networks. When a user downloads a file using BitComet, the software connects to the network of other users who are also downloading or sharing the same file. The app then downloads the file in small segments from multiple peers simultaneously, allowing for faster download speeds and improved reliability. Once the user downloads a segment of the file, it also becomes available to other users who are looking to download the file. This means that the more people who are downloading and sharing a particular file, the faster it will download for everyone involved.
Digital Forensics Value of BitComit
BitComet can be useful in digital forensics investigations related to intellectual property theft, cybercrime, data leakage, and network intrusion. Tracing the sources and destinations of files and examining the metadata can help in providing evidence and identifying individuals or groups involved in illegal activity.
Location of BitComit Artifacts
The artifacts can be found at the following location:
%systempartititon%\%username%\\AppData\Roaming\BitComet\
Analyzing BitComit with ArtiFast
This section will discuss how to use ArtiFast to extract BitComit from Windows and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select BitComit artifacts.
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Window BitComit artifacts in ArtiFast.
BitComet Torrents Artifact
- Date - The date and time when the torrent file was added.
- Uploaded Bytes - The number of bytes uploaded.
- Downloaded Bytes - The number of bytes downloaded.
- Files - The list of files in the torrent.
- Peers - The list of IPs and ports of the peers.
- Trackers - The list of trackers in the torrent.
- Was Moved - A flag indicating whether the torrent file was moved.
- Finish Date Time - The date and time when torrent finished downloading.
- Torrent Name - The name of the torrent.
- Downloaded Size - The size of the download.
BitComet Torrents Downloads Artifact
- Date - The date and time when the torrent file was added.
- Discarded Data - The number of bytes discarded.
- Uploaded Bytes - The number of bytes uploaded.
- Directory Path - The path where the files were downloaded.
- Data Type - The type of data in the torrent.
- File Name - The name of the torrent file.
- Downloaded Bytes - The number of bytes downloaded.
- File Size - The size of the files in the torrent.
For more information or suggestions please contact: amro.alshadfan@forensafe.com
