Bencode Editor For Mac
Windows x64 Windows x32 macOS Sources View on GitHub Donate Summary. Cross-platform application intended to create and edit.torrent and uTorrent.dat files. Replacement for BEncode Editor which has modern design and extra features. 2020.09.22 - DreamPlan Plus Home Design Software for Mac 2020.09.22 - Clean Disk Free 2020.09.22 - Doxillion Document Converter Free 2020.09.22 - Syncios Data Recovery for Mac 2020.09.22. Bencode Editor software Filter: All Freeware Demo. Yet another blog about code and computers. Installing Arch Linux on the Pinebook Pro. Code editor free download - VideoPad Free Video Editor for Mac, Plain Text Editor, Macsome Audio Editor, and many more programs.
This is the forensic “Cheat Sheet” portion of my Master’s paper. This post involves only the uTorrent client.
Appendix A – uTorrent Forensic Notes:
Bencode Editor For Mac Os
settings.dat -breakdown of entries of forensic note (Viewed using BEncode Editor Program):
note: (i) = integer value expected; (b) = binary value expected
| autostart(i)=0 | DEFAULT t(i)=0 Programs of forensic notWindows (minimized) 0 is Auto Start OFF (If Auto Start is ON there will be no autostart(i) entry in settings.dat) |
| bind_port(i)= **** | The networking port this client is running on. Varies on each install. |
| born_on(i)= 13036184115 | The number indicates the time and date the client program was installed on. This time is in Lightweight Directory Access Protocol (LDAP) time representing the number of “100-nanosecond intervals since January 1, 1601 UTC”. To be converted the user must add seven additional 0’s to create the 18 digit time representation. |
| dir_active_download(b) (only present if changed by user) | Location set by user to save “new downloads” in. |
| dir_autoload(b) (only present if changed by user) | Location set by user to Autoload Torrent files from. The client will scan the folder looking for .torrent files to start loading. |
| dir_completed_download(b) (only present if changed by user) | Location set by the user to store Completed downloads in. |
| dir_completed_torrents(b) (only present if changed by user) | Location set by the user to store completed .torrent files in. An archive essentially. |
| dir_torrent_files(b) (only present if changed by user) | Location set by user to store torrent files downloaded by the client (RSS feed). |
| runs_since_born(i) | Number of times the program started and closed since the install. Updated on close of program. |
| runtime_since_born_secs (i) | Time in seconds the program has been running on the PC. |
| search_list(b) | List of Search sites used in clients toolbar. This can be added to by the user to assist in locating torrents. This will open up the user’s web browser so any artifacts of its usage may be found in the Internet History files. |
| settings_saved_systime(i) | Last time the client settings were changed. This is based on Epoch or Unix system time. This is the number of seconds that have elapsed since January 1, 1970 (UTC). |
resume.dat – Breakdown of entries of potential forensic significance.
Note: The following are entries for each active torrent entry in the resume.dat file. note: (i) = integer value expected; (b) = binary value expected
Bencode Editor Mac Os X
| added_on (i)= | Date and Time Torrent added to client – Epoch/Unix Time |
| completed_on (i)= | Date and Time Torrent was completely downloaded OR Created in Epoch/Unix Time. |
| created_torrent (i)=0 | Did this client create the listed torrent: 1 = Client created torrent 0 = Client did not create torrent (downloaded) |
| download_url (b) = | If the user added the Torrent file using the clients “Add torrent from URL” function then this would list the URL here. |
| downloaded (i) = | Number of bytes downloaded of the file by the client. |
| last seen complete (i)= | Last time client was seeding complete file. In Epoch/Unix time. |
| last_active (i)= | Last Time the file was being actively seeded or shared from client PC. This time is in |
| path (b)= | Path on the Local Machine where Incoming Files are saved (the Folder etc.) |
| peers6 (b)= | Other Peers sharing this particular file at the time of exiting (the updating of the resume.dat file). User must convert from HEX to decimal to get IP Value. |
| runtime (i)= | Time File has been downloading in client (or total being seeded following downloading) |
| seedtime (i)= | Time File has been seeded by client in seconds |
| started (i)= | File status when resume.dat was last written: “0”= Stopped “1”=Force Started “2”=Started “3”=Running/not downloading |
| time (i)= | Last Time torrent was Listed in BitTorrent Client (any status). All listed Torrent in “resume.dat” appear to have the same time (Epoch/Unix). (Last Shutdown time of Client?) |
| uploaded (i)= | Total UPLOADED (SHARED) in bytes of data for that specific file. |