ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "Libpff" and "Fast Thunder"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Example queries)
 
Line 1: Line 1:
{{Infobox_Software |
+
'''Fast Thunder''' (aka Xunlei) is a [[Download manager|download manager]] developed by Thunder Networking Technologies.
  name = libpff |
+
  maintainer = [[Joachim Metz]] |
+
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
+
  genre = {{Analysis}} |
+
  license = {{LGPL}} |
+
  website = [http://libpff.sourceforge.net libpff.sourceforge.net] |
+
}}
+
  
The '''libpff''' package contains a library and applications to read the [[Personal Folder File (PAB, PST, OST)]] format.
 
  
== History ==  
+
== SuperDownload database ==
 +
The '''SuperDownload database''' can be found at:
  
Libpff was created by [[Joachim Metz]] in 2008, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
+
On Windows
 +
<pre>
 +
C:\Program Files\Thunder Network\Thunder\data\SdInfoDb.dat
 +
</pre>
  
Libpff is a rewrite of earlier work on the PST file format by the [[libpst|libpst project]].
+
This file uses the [[SQLite database format]].
  
Libpff is a cross-platform shared library that support PST, OST and PAB files. Currently the data in PAB files is only partially supported.
+
The timestamp:
Support was added to deal with corrupted files and to recover data.
+
* SuperDownloadInfo.ContentDownloadTime is stored as BIGINT and contains a POSIX timestamp
 +
* SuperDownloadResource.DownloadTime is stored as BIGINT and contains '''presumably''' a POSIX timestamp
  
== Tools ==  
+
== Task database ==
The '''libpff''' package contains the following tools:
+
The '''Task database''' can be found at:
* '''pffexport''', which exports the items stored in PAB, PST and OST (PFF) files
+
* '''pffinfo''', which shows information about PFF files.
+
  
'''pffrecover''', has been replaced by '''pffexport -m recovered'''
+
On Windows
 +
<pre>
 +
C:\Program Files\Thunder Network\Thunder\Profiles\TaskDb.dat
 +
</pre>
 +
 
 +
The timestamp:
 +
* TaskBase.CreationTime is stored as BIGINT and contains a POSIX timestamp shifted 24-bits to the left, e.g.
 +
<pre>
 +
printf "0x%x\n" 22090158425767936
 +
0x4e7ae1ce000000
 +
 
 +
date -d @$(( 22029112998625280 >> 24 ))
 +
Thu Aug 11 06:37:35 CEST 2011
 +
</pre>
 +
 
 +
=== Example queries ===
 +
Some example queries:
 +
 
 +
To get an overview of the tasks:
 +
<pre>
 +
SELECT datetime((TaskBase.CreationTime >> 24), "unixepoch"), TotalReceiveSize, TotalSendSize, Url, ReferenceUrl, Name, Description, SavePath FROM TaskBase;
 +
</pre>
  
 
== See Also ==
 
== See Also ==
* [[libpst]]
+
 
 +
* [[SQLite database format]]
  
 
== External Links ==
 
== External Links ==
* [http://code.google.com/p/libpff/ Project site]
+
* [http://en.wikipedia.org/wiki/Xunlei Wikipedia article on Fast Thunder (Xunlei)]
* [https://sourceforge.net/projects/libpff/ Old project site]
+
 
 +
[[Category:Applications]]
 +
[[Category:Download Managers]]

Revision as of 11:50, 21 March 2012

Fast Thunder (aka Xunlei) is a download manager developed by Thunder Networking Technologies.


SuperDownload database

The SuperDownload database can be found at:

On Windows

C:\Program Files\Thunder Network\Thunder\data\SdInfoDb.dat

This file uses the SQLite database format.

The timestamp:

  • SuperDownloadInfo.ContentDownloadTime is stored as BIGINT and contains a POSIX timestamp
  • SuperDownloadResource.DownloadTime is stored as BIGINT and contains presumably a POSIX timestamp

Task database

The Task database can be found at:

On Windows

C:\Program Files\Thunder Network\Thunder\Profiles\TaskDb.dat

The timestamp:

  • TaskBase.CreationTime is stored as BIGINT and contains a POSIX timestamp shifted 24-bits to the left, e.g.
printf "0x%x\n" 22090158425767936
0x4e7ae1ce000000

date -d @$(( 22029112998625280 >> 24 ))
Thu Aug 11 06:37:35 CEST 2011

Example queries

Some example queries:

To get an overview of the tasks:

SELECT datetime((TaskBase.CreationTime >> 24), "unixepoch"), TotalReceiveSize, TotalSendSize, Url, ReferenceUrl, Name, Description, SavePath FROM TaskBase;

See Also

External Links