Identifying an existing file via KaZaA artefacts

This child exploitation case study details two newly developed techniques for investigating illegal activity on peer-to-peer networks (names have been changed as the case is ongoing). The defendant in this case is accused of taking three indecent digital video clips of a minor, and sharing these on the KaZaA peer-to-peer file sharing network. The first search method focuses on post-mortem analysis of a forensic duplicate of the defendant's hard drive. The second method employs techniques for live searching of the peer-to-peer network. Tools used to automate these searches are presented. Although the tools and techniques developed for this investigation did not locate additional evidence, they are valid and may be useful in future investigations.