Difference between pages "Libpff" and "Fast Thunder"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Example queries)
 
Line 1: Line 1:
{{Infobox_Software |
+
'''Fast Thunder''' (aka Xunlei) is a [[Download manager|download manager]] developed by Thunder Networking Technologies.
  name = libpff |
+
  maintainer = [[Joachim Metz]] |
+
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
+
  genre = {{Analysis}} |
+
  license = {{LGPL}} |
+
  website = [http://libpff.sourceforge.net libpff.sourceforge.net] |
+
}}
+
  
The '''libpff''' package contains a library and applications to read the [[Personal Folder File (PAB, PST, OST)]] format.
 
  
== History ==  
+
== SuperDownload database ==
 +
The '''SuperDownload database''' can be found at:
  
Libpff was created by [[Joachim Metz]] in 2008, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
+
On Windows
 +
<pre>
 +
C:\Program Files\Thunder Network\Thunder\data\SdInfoDb.dat
 +
</pre>
  
Libpff is a rewrite of earlier work on the PST file format by the [[libpst|libpst project]].
+
This file uses the [[SQLite database format]].
  
Libpff is a cross-platform shared library that support PST, OST and PAB files. Currently the data in PAB files is only partially supported.
+
The timestamp:
Support was added to deal with corrupted files and to recover data.
+
* SuperDownloadInfo.ContentDownloadTime is stored as BIGINT and contains a POSIX timestamp
 +
* SuperDownloadResource.DownloadTime is stored as BIGINT and contains '''presumably''' a POSIX timestamp
  
== Tools ==  
+
== Task database ==
The '''libpff''' package contains the following tools:
+
The '''Task database''' can be found at:
* '''pffexport''', which exports the items stored in PAB, PST and OST (PFF) files
+
* '''pffinfo''', which shows information about PFF files.
+
  
'''pffrecover''', has been replaced by '''pffexport -m recovered'''
+
On Windows
 +
<pre>
 +
C:\Program Files\Thunder Network\Thunder\Profiles\TaskDb.dat
 +
</pre>
 +
 
 +
The timestamp:
 +
* TaskBase.CreationTime is stored as BIGINT and contains a POSIX timestamp shifted 24-bits to the left, e.g.
 +
<pre>
 +
printf "0x%x\n" 22090158425767936
 +
0x4e7ae1ce000000
 +
 
 +
date -d @$(( 22029112998625280 >> 24 ))
 +
Thu Aug 11 06:37:35 CEST 2011
 +
</pre>
 +
 
 +
=== Example queries ===
 +
Some example queries:
 +
 
 +
To get an overview of the tasks:
 +
<pre>
 +
SELECT datetime((TaskBase.CreationTime >> 24), "unixepoch"), TotalReceiveSize, TotalSendSize, Url, ReferenceUrl, Name, Description, SavePath FROM TaskBase;
 +
</pre>
  
 
== See Also ==
 
== See Also ==
* [[libpst]]
+
 
 +
* [[SQLite database format]]
  
 
== External Links ==
 
== External Links ==
* [http://code.google.com/p/libpff/ Project site]
+
* [http://en.wikipedia.org/wiki/Xunlei Wikipedia article on Fast Thunder (Xunlei)]
* [https://sourceforge.net/projects/libpff/ Old project site]
+
 
 +
[[Category:Applications]]
 +
[[Category:Download Managers]]

Revision as of 07:50, 21 March 2012

Fast Thunder (aka Xunlei) is a download manager developed by Thunder Networking Technologies.


SuperDownload database

The SuperDownload database can be found at:

On Windows

C:\Program Files\Thunder Network\Thunder\data\SdInfoDb.dat

This file uses the SQLite database format.

The timestamp:

  • SuperDownloadInfo.ContentDownloadTime is stored as BIGINT and contains a POSIX timestamp
  • SuperDownloadResource.DownloadTime is stored as BIGINT and contains presumably a POSIX timestamp

Task database

The Task database can be found at:

On Windows

C:\Program Files\Thunder Network\Thunder\Profiles\TaskDb.dat

The timestamp:

  • TaskBase.CreationTime is stored as BIGINT and contains a POSIX timestamp shifted 24-bits to the left, e.g.
printf "0x%x\n" 22090158425767936
0x4e7ae1ce000000

date -d @$(( 22029112998625280 >> 24 ))
Thu Aug 11 06:37:35 CEST 2011

Example queries

Some example queries:

To get an overview of the tasks:

SELECT datetime((TaskBase.CreationTime >> 24), "unixepoch"), TotalReceiveSize, TotalSendSize, Url, ReferenceUrl, Name, Description, SavePath FROM TaskBase;

See Also

External Links