Abstract. The BitTorrent client application is a popular tool to distribute the large files over the Internet. However, the utility can be used for the illegal distribution of some files. Such an activity is considered as a cybercrime. In order to aid the forensics investigator to fight against the cybercrimes we carried out the research, during which we investigated the evidences left by BitTorrent client application in the local computer operating under Windows 8.1. During the experiment, we studied the evidences left by the BitTorrent client in the Windows registry and in the BitTorrent client configuration files. We investigated as well the possibilities to remove the evidences of the use of the BitTorrent application in order to conceal such a fact. The experiment revealed that the evidences are left either in the Windows registry or in the BitTorrent configuration files or both depending on the removal mode of the BitTorrent client application. The BitTorrent configuration files can reveal only whether the cybercrime was committed.
Venčkauskas et al. REF investigated the latest version of the BitTorrent client for the Windows 8.1 operating system.
Investigation of Artifacts Left by BitTorrent Client on the Local Computer Operating under Windows 8.1
ITC
ITC
Computer Science