Products

P2P MarshalTM Forensic Edition Release 3.0 Description

A description of the new features and capabilities of P2P Marshal Forensic Edition follows. Please note that Release 3.0 pertains only to the Forensic Edition version of P2P Marshal and is not available for the Field Edition version at this time.

Release 3.0 updates support to the current release levels (as of the date of Release 3.0) of the supported clients: Ares, BitTorrent, FrostWire, Kazaa, LimeWire, μTorrent and Vuze (Azereus 3+).

P2P Marshal Forensic Edition Release 3 provides contextual help. All windows have a question mark icon. Clicking on the icon brings up a help window within the main P2P Marshal window. The help text is specific to the current window, such as specific P2P clients (LimeWire, Ares, etc.) or supported output formats when generating a report.

An example of contextual help is shown below (click image to enlarge).

P2P Marshal Forensic Edition Release 3 provides an enhanced built-in image viewer that included a thumbnail viewer. There are two ways to open the viewer. The first way is to select Show all files in thumbnail browser from the Tools menu. The second way is to select one or more files in the Shared/Downloaded Files window and then press the right mouse button and select Show in Image Thumbnail Browser.The image browser window has two modes, thumbnails and single image.           

Thumbnail Viewer

Because the thumbnail viewer is designed for rapidly viewing a large number of images,it opens in a separate, full-screen window. Each thumbnail image is 100x100 pixelsApproximately 70 thumbnails fit on a standard 1280x1024 monitor, and more fit on oneswith higher resolution.

An example of the thumbnail window is shown below (click image to enlarge).

The main thumbnail viewer window has two sections. An information block is on the left side of the window and the thumbnail images are on the right side of the window.

Information Block: The information block provides details about the currently selected file, which is indicated by a dashed rectangle around it (the fourth from the left and the sixth down from the top in the example above). Click the mouse on a thumbnail image to select it.

File Info displays the location and size of the file.

Embedded Metadata displays available metadata. Exif data, such as Date/Time, location, is displayed, if available. Basic image data, such as height, width, and color depth, is always displayed.

Thumbnails: The images are displayed as a grid of thumbnails. Above the thumbnails is the current and total number of pages of thumbnails (e.g., “Page 1/71”). The page can be advanced with the PageDown key (go backwards with the PageUp key) or moving the scroll bar. Thumbnail images are loaded asynchronously, so that page advancement occurs as rapidly as possible. To the right of the scrollbar is a region that indicates what pages are currently cached. Light indicates cached, dark indicates not currently cached. If multiple images are selected, multiple information blocks will stack on top of each other, with only one block visible at a time.

Any file that is not in a supported image format will be indicated with a box containing the message “Error. File is corrupted or isn’t an image.” Supported image formats are:  gif, jpeg, png, bmp, and some TIFF formats.

By clicking the mouse on a single image, a new tab is created that displays a single image. Hitting the Enter key does the same thing to the currently selected image.

Single Image Viewer

When the investigator either double-clicks on a thumbnail image or selects enter on a selected image, a new tab will display the single image. The user can zoom in and out on that image. Clicking on additional images from the thumbnail browser will open additional tabs with those images. Clicking on the tab at the top will navigate between different open images and the thumbnail browser. Each single image tab can be closed by clicking on the “X” on the right side of its tab.

An example of a single image in the thumbnail viewer is shown below (click image to enlarge).