Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Ares and Lime Pro Dat File Decryptor

This script will decrypt the data from the .dat files used by the Ares and Lime Pro P2P file trading programs.  The encryption is a simple stream cipher.

Files that are supported:

  • ShareH.dat
  • ShareL.dat
  • PHashIdx.dat

The script can use the data from the afore-mentioned files in order to generate file-recovery records, which can be used by the Ares Deleted File Recovery EnScript.

The data-bookmark created by the script will only display the first 1499-bytes of any p-hash due to a limitation in EnCase. This does not affect the file created for the purposes of file-recovery.

Research by Matt McFadden and James Habben. Originally created by James Habben.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


FAQ

Version: 3.1
Tested with:
EnCase Forensic 8.08.00.140
Developer: Simon Key
Category: Artifact

2 Downloads
2 Downloads in last 6 months