Sunday, November 15, 2009

EnScript to find Limewire download remnants.

This EnScript was written for a reader who requested an EnScript to search for the common "URN:SHA1:{Sha1_base32 hash} associated with Limewire downloads. When run, the EnScript will search SELECTED files for that tag. If found, it will read the SHA1_base32 value that immediately follows the tag and then compute a SHA1_base32 hash for all the files that have matching extensions to those you specify. If a file with the same hash is found, it is bookmarked as a matching file.

Once completed, check the bookmark folder for two different folders. One contains any "URN:SHA1" tags found in the selected files, and the second one is each file that matches a found SHA1 value

Download Here


Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles