Presentation from October 2010:
As a method for quick and efficient sharing of files, many computer users have turned towards P2P applications to obtain information and media that they require at home and on the job. With transmissions occurring over non-HTTP connections, even many technically savvy users don't realize just how easily their downloads and habits can be tracked and monitored across a network. This technical talk will delve into the network and file system forensic artifacts of P2P applications, focusing more towards BitTorrent but also including other relevant protocols. It will show what artifacts are left behind, and how some can be hidden away by knowledgeable users. It will also cover many of the new legal challenges that P2P users face and some of the newest protocol implementations created to bypass these legal restrictions. This information is focused towards forensics examiners and network administrators that wish to mitigate the risks of P2P communications, though the information is appropriate for all audiences and skill levels. This is a similar talk to one given at the DoD Cyber Crime Conference, GFIRST, and in briefings to the U.S. DoJ and various law enforcement agencies, though recreated for BSides Delaware.