This EnScript searches for bookmarks and decodes GigaTribe V3 download state information.

Use of the script would be beneficial when investigating a group of users who are using GigaTribe to share files of an illicit nature.

This data is to be found within a file with the same name of file being downloaded but with the added file-extension of '.downloading.state'.

The download-state information contains the GigaTribe URL of the file being dowloaded (including the user-name of the user sharing the file) the size of the file its last-written date the password needed to access the file (if a password was set at a parent folder level) the download state (paused or active) and the download-extent data (usually only present if the download is current and some data has already been downloaded).

The script also reads what appears to be a 4-byte checksum (hash)  which may sometimes be null. The algorithm used to create this hash is not known.

Progress may be monitored via the console.

The script produces a tab-delimited spreadsheet file as well as bookmarks.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training