EnCase App Central
Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.Become a Developer
GigaTribe Download State Information Finder
This EnScript searches for bookmarks and decodes GigaTribe V3 download state information.
Use of the script would be beneficial when investigating a group of users who are using GigaTribe to share files of an illicit nature.
This data is to be found within a file with the same name of file being downloaded but with the added file-extension of '.downloading.state'.
The download-state information contains the GigaTribe URL of the file being dowloaded (including the user-name of the user sharing the file) the size of the file its last-written date the password needed to access the file (if a password was set at a parent folder level) the download state (paused or active) and the download-extent data (usually only present if the download is current and some data has already been downloaded).
The script also reads what appears to be a 4-byte checksum (hash) which may sometimes be null. The algorithm used to create this hash is not known.
Progress may be monitored via the console.
The script produces a tab-delimited spreadsheet file as well as bookmarks.
This script was developed for use in EnCase training. For more details, please click the following link:Download Now
EnCase Forensic 8.07