Kuiper Forensics

PeerLab

Applications

PeerLab is able to evaluate the following P2P-databases

• eMule (known.met)
• Kazaa (data256.dbb, data1024.dbb)
• Google Hello (*.chatlog, *.filmstrip)
• Bittorrent (*.torrent)
• LimeWire (library.dat, library5.dat, fileurns.cache)
• Shareaza (library1.dat, library2.dat)

PeerLab is able to evaluate the following "Instant Messaging"-databases

• ICQ (messages.mdb, messages.qdb)
• Gadu-Gadu (Archive.db, archives.dat)
• GigaTribe (chathistory_*.dat)
• Skype (main.db)
• ooVoo (ChatHistory.db)

PeerLab is able to evaluate the following "Webdisk"-databases

• Dropbox (filejournal.db, contacts.db)
• Google Drive (snapshot.db, sync_config.db)

PeerLab is able to detect the following applications

• P2P (387 applications in 4043 versions)

2Peer, AA File Share, ABC, Addax, aimini P2P software, Aimster, AirDC++, Alliance, aMule, Anomos, ANts P2P, Anubis P2P, ApexDC++, appleJuice, Arctic Torrent, Ares Destiny, Ares Galaxy, Ares Galaxy Download Client, Ares Galaxy Lite, Ares Galaxy Professional, Ares Gold, Ares Plus, Ares Torrent Downloader, Aria2, Artemis, AudioGalaxy Rhapsody, AudioGalaxy Satellite, audioGnome, AXEPTool, Azureus - Azureus Vuze, BadBlue PE, BearFlix, BearShare, BearShare Gold, BearShare Lite, BearShare MP3, BearShare MP3 Downloader, BearShare Music, BearShare Premium P2P, BearShare Professional, BearShare Test, BearShare Turbo, Bit Che, Bit Fire, BitAnarch, BitBeamer, BitBuddy, Bitcasa, BitComet, BitComet Turbo, BitHit, BitHost, Bitlord, BitRope P2P, BitRope Sharing, BitRope Torrents, bitShare, BitSpirit, BitThief, BitTornado, BitTorrent, BitTorrent MP3, BitTorrent PRO, BitTorrent++, BitTyrant, BitZilla, BLAckFLAg, Blitzi Bitcollider, Blubster, BTGetit, Burst Plus!, Burst!, Cabos, Capster, Chinafinder, CitrixWire, Cosmo P2P, Crux P2P, CuteMX, CZDC, dbgo, DC++, Deepnet Explorer, Dehinter, Deluge, DexterWire, Diet Kazaa, Direct Connect, DreaMule, eAnt, Easy File Sharing Web Server, easyMule, EasyTorrent, eBit Personal, eChanblard, eDonkey Plus, eDonkey2000, eFileGo, Emerald P2P, Emscher, eMule, eMule AdunanzA, eMule Applejuice, eMule eF-Mod, eMule Espana Mod, eMule File Swap, eMule Future, eMule hebMule, eMule iONiX, eMule Lite, eMule Morph Most Wanted, eMule MorphXT, eMule Pawcio, eMule PhoeniX, eMule Plus, eMule ScarAngel, eMule SharkX, eMule Sivka, eMule Titandonkey, eMule TK4 Mod, eMule Vista Edition, eMule X Mod, eMule Xtreme Mod, eMule+Ultra, emule2rt, eMuleFuture, Enhanced CTorrent, Entertainment World Downloads, Epicea, eXeem Lite, ExoSee, Fast Torrent, File Bus, File Sharing Wizard, Filenavigator, FilePipe P2P, FileRogue, FileSeeker, FileShare, Filetopia, Flash! Torrent, FlylinkDC++, FolderShare, Freenet, Frost, FrostWire, FunToosh, Furthur, G3 Torrent, Gazzera, GigaTribe, Gimme P2P, Gnotella, Gnucleus, GnucleusLAN, Gnuminous, GNUnet, Gnutella, Gnutella Turbo, GnutellaWire, Google Hello, Grouper, Gullishare, Halite, Hamachi, Hybrid Share, Hydranode, i2p, I2Phex, iMesh, iMesh Light, Imesh PRO, Imesh Turbo, iMP3Tunes, Java Open Direct Connect, JavaABC, jMule, JPartialDownloader, K-Lite, K-LitePro, Kazaa, Kazaa Light Resurrection, Kazaa Lite, Kazaa Lite Revolution, Kazaa Media Desktop, KCeasy, KCeasy Portable, Kdrive, KiBi-Share, Koala DC, Kommute, Konspire, KosmoSol Distributed Desktop Search, LDC++, LeechCraft, LemonWire, LH-ABC, Libox, LimeSharePro, LimeWire, LimeWire Download Client, LimeWire MP3, LimeWire Music, LimeWire PRO, LimeWire Turbo, LittleShot, lopster, Lphant, LuckyWire, Luke, Mammoth, Manolito, Mastermax, Memeo Share, MetaDonkey, Meteor Share, MFC MUTE, Minitasking, MLDonkey, Moonlight Torrent, MooPolice, MoorHunt, Morpheus, Morpheus Games Downloader, Morpheus Music, Morpheus Premium, Morpheus Professional, Movie Torrent, MP3 Rocket, MP3 Wolf, MP3Torpedo, MUTE, MuWire, My Kazaa Gold, myNapster, myTunes Redux, Nakido Flag, Napigator, Napshare, Napster, NetShare, NetXfer, Newtella, Nodezilla Agent, Nova, Nova Torrent, oDC, Offload, OneSwarm, Open Direct Connect, OpenOasis, Opera Unite, Osiris, Overnet, OvernetClc, P2P Posse, P2P Rocket, P2P Share Spy, p300, Pando, Parrot BitTorrent Client, Peer2Mail, PeerAware, PeerFolders, Peerguardian, PeerWeb DC++, Perfect Dark, Phex, Phosphor, Piolet, Pixvillage, Project Neon, PTC, Pulsarr, Pump, qBittorrent, QNext, RainKaZaA, Rapid Connect, Rapidme, Rapigator, Remobo, Retroshare, RevConnect, RocketTorrents, Rodi, Rootnode Live Music Network, RShare, RSX++, Ruby P2P Outbreak, Rufus, SababaDC, Sapphire P2P Rush, Schnap, Scour Exchange, Share, Shareaza, Shareaza Lite, Shareaza Pro, ShareazaPlus, ShareDix, ShareGhost, ShareIT, Sharest, Sharetastic, Sharezilla, Sharin'Hood, sharkTorrent, Shifty, SimpleBT, SkyDownloader, Skyshare Manager, SmVDC++, SockeToome, SoMud, SongSpy XE, Sopcast, Soulseek, Sour Exchange, Speedy P2P Movie Finder, Spinfrenzy Xchange, SpinXpress2, StarMule, Stealthnet, Steganos Secure Filesharing, StrongDC++, StulleMule, Suicide, Sumi, SunshineUN, Swapper.NET, Swaptor, Taifun File Share, Tappin, TekNap, The Owner Free File System, Tirminal, Tis Another Newtella Klient, Tixati, Toadnode, TopBT, TorenKey, Torrent Captor, Torrent Episode Downloader, Torrent Monster, Torrent Search, Torrent Search Expert, Torrent Searcher SA, Torrent Swapper, Torrent Torque, Torrentmonster, TorrenTopia, TorrentRover, Tribler, Trilix, Trusty Files, Trusty Files Pro, TruxShare, TurboBT, TurboWire, Urlin.net, uTorrent, VeryCD easyMule, VIP-Torrent, Vuze, Waste, windroplr, WinMX, WinMX MP3, WinMX Music, Winny, WinZO, WiPeer, WWW File Share Pro, XanTorrent, XBT Client, XCaramba, xmule2 ui web, xmule2 ui wx, Xnap, XoLoX, Yaga Share, Yo!NK, zButterfly, zK++, ZPoC, Zultrax P2P

• Instant Messaging (139 applications in 1221 versions)

&RQ, AChat, Akeni Messenger (Jabber Edition), Alibaba Trademanager, aMSN, AOL Instant Messenger, AYTMM, BigAnt Messenger, BINGOOO, BitTorrent Bleep, BitWise, Bopup Messenger, BRAVIS Galaxee 4free, Brosix Messenger, Buddy2Buddy, Buzz IM, Camcolada, Camfrog, ChatFlow, ChatON Alarm, Chit Chat for Facebook, Citron IM, climm, Collanos Workplace, Complete Messenger, CSpace, Dell Video Chat, Digsby, Dixipe, DKMessenger, Easy Message, Exodus, Eyeball Chat, Facebook Messenger, Facebook Messenger (inofficial), FIMTalk, Flashdeli, Gadu-Gadu, Gaim, GameChat Messenger, Gamers Own Instant Messenger, GetInstant.info, Gizmo5, Globe7, GMX MultiMessenger, goober Messenger, Google Talk, HLSW, ICQ, ICQ Lite, Icu2, IM2, ImGiant, IMVU Avatar Chat Software, Instan-t, Instantbird, IntraMessenger, J.I.M, Jabber Messenger, Jabbin, Jitsi, JoPop, Jostejoogar Instant Messenger, KooKaDoo, Loober, Lotus Notes Sametime, Mail.ru Agent, Marvin Jabber Client, Microsoft SharedView, miniaim, MiPhone, Miranda IM, Miranda ME, MirandaFusion, MSN Messenger, Mumble, MySpaceIM, Naevisu Facebook IM, Nimbuzz, ooVoo, OpenICQ, OpenTalk, Paltalk Messenger, Pandion, Pidgin, PowWow, Psi, QIP 2005, QIP 2010, QIP 2012, QIP Infium, Qnext, QQ International, QuteCom, qutIM, RaidCall, Raketu, S-IMessenger, Sada Messenger, SideWinder Game Voice Share, sim, Sipear, Skype, Smooch, SourceTec Messenger, SpeedyMSN, SunnyMedia Client, T-Online Messenger, tavmsn, TeamSpeak 3 Client, TeamTalk, TerraIM, TorChat, Trillian, Trillian Astra Pro, TryFast Messenger, TUMessenger, UrduLink Messenger, Ventrilo, Viber, Vovox, VZOchat, WEB.DE MultiMessenger, WengoPhone, WhatApp Client (inofficial), Windows Live Messenger, Windows Messenger, Windows NetMeeting, WinSent Messenger, Wippien, World of Chat Messenger, WuWu, Xfire, XIMA, XSmessenger, Yahoo Messenger, ysmICQ, Zone Video Chat, ZooskMessenger

• Usenet (74 applications in 434 versions)

40tude Dialog, aEton CommunicaEtor, aEton Usenet Wizard, Alphaload Software, alt.binz, Amipic ShareMaster, Android Newsgroup Downloader, Another File, ASP1-A3, AutoPix, Bin Jet, Binary Boy, Binary News Reader, Binary News Reaper, BinaryVortex, BinBot, BinTube Usenet Reader, BinTube Usenet Reader Pro, Binverse, DreamLoad, Express NewsPictures, FastNZB, Forte Agent, FreeXP, g3NewsIT, GEEMANs UseNet Browser, GrabIt, Gravity, HelloNzb, iLoad, JBinUp, MesNews, Mister Pix II, MP3 Grouppie, News File Grabber, News Rover, NewsBin Pro, Newsflash, Newsgroup Commander Pro, Newsgroups Picture Downloader, NewsLeecher, NewsMan Pro, NewsPro, NewsReactor, NewsShark, NewsSIEVE, NewzCrawler, nget, ngetlite, Noworyta News Reader, NZB, NZBGet, nzbgui, Ozum, Pan, Picture Patrol XP, Power Post A&A, SABnzbd, SBNews, slrn, Sophax, Sponge, Super News Reader, SuperNZB, Surfino Newsreader, Sylpheed, TLNews Newsreader, UltraLeecher, Usenet Explorer, Usenet.nl, UseNeXT, XanaNews, Xnews, XPN

• WebDisks (75 applications in 268 versions)

1&1 Office-Drive Manager, 4shared Desktop, 4Sync, Amazon Cloud Drive, ASUS Webstorage, Back2Cloud, Backblaze, BackUPMAX, Bitcasa, BitWay Online Backup, Box Sync, BuddyBackup, BullGuard Backup, Carbonite Backup, CloudBerry Online Backup, CloudDrive, COMPUTERBILD Cloud, Copy, cubby, CX, Diino, DriveHQ FileManager, DriveHQ Online Backup, DriveOnWeb, Dropbox, eDisk, ElephantDrive Desktop, FilePC, FluffyApp, g2Peer, GDocsDrive, Genie Online Backup, Gladinet Cloud Desktop, GMailFS, Google Drive, HTB Remote Backup, hubiC, humyo.de SmartDrive, iCloud, IDrive, IDriveSync, iFolder, Jungle Disk Desktop, LiveDrive, MailDrop, Memopal, Microsoft Skydrive, Mozy, MyPC Backup, Nomadesk, Novell iFolder, OpenDrive, ownCloud Client, PowerFolder, SafeCopy, SkyBackups, SOS Online Backup, South River WebDrive, Spideroak, SquirrelSave, STRATO HiDrive, SugarSync, Super Flexible File Synchronizer, synables desktop SE, TeamDrive, Telekom Mediencenter, TornadoDrive, Trend Micro SafeSync, TrueShare, UpdateStar Online Backup, Vembu StoreGrid Backup Software, WEB.DE SmartDrive Manager, Windows Live Sync, Wuala, zuuMedia SmartDrive

Scanning

In order to use the scanner a case has to be created by using the "Create Case"-button.

You can now enter case-specific information which will also be used in generated reports.

The next step is to tell PeerLab where to search for applications. In this example the "Program Files"-folder was chosen.

If "Deep Scan" is selected an MD5-hash is calculated for all known extensions of P2P-programs (e.g. *.exe, *.jar, *.dll) and compared with the internal database.



After pushing the "start examination"-button the scanning-process starts. During the scanning-process the currently processed directory is displayed below the results-window.

After scanning is completed an overview of found applications is given as shown below. In this example 4 P2P-applications, 1 usenet-client (both database-verified) were found. Additionally a P2P-application was found which matches predefined search-criteria but has no entry in the database as it is either unknown or a new version.

The results are shown in the results-window. In this example the original filename of Shareaza was "Email-Client.exe" because of the deep-scan option the exe-file was scanned, an md5-hash compared with the internal database and a match was found.

The results are stored in the case-file. A report can be generated easily with the "generate report"-button. An example-report would like as follows: