Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
/div>

GigaTribe Download State Information Finder

This EnScript searches for bookmarks and decodes GigaTribe V3 download state information.

Use of the script would be beneficial when investigating a group of users who are using GigaTribe to share files of an illicit nature.

This data is to be found within a file with the same name of file being downloaded but with the added file-extension of '.downloading.state'.

The download-state information contains the GigaTribe URL of the file being dowloaded (including the user-name of the user sharing the file) the size of the file its last-written date the password needed to access the file (if a password was set at a parent folder level) the download state (paused or active) and the download-extent data (usually only present if the download is current and some data has already been downloaded).

The script also reads what appears to be a 4-byte checksum (hash)  which may sometimes be null. The algorithm used to create this hash is not known.

Progress may be monitored via the console.

The script produces a tab-delimited spreadsheet file as well as bookmarks.

Download Now

Download Now



Version: 1.1.2
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Artifact