Computer Forensics Software analyzes P2P file sharing activity.
Press Release Summary:
P2P Marshal(TM) v3.1.0 automatically detects, extracts, and analyzes P2P (peer-to-peer) file sharing evidence on hard drives. Forensic Edition(TM) software-only version installs and runs on investigator's workstation to analyze mounted disk image. Offered on and run from USB drive, Field Edition(TM) can conduct live investigations as well as analyze mounted disk images. P2P client program support covers Ares, BitTorrent, Frostwire, LimeWire, uTorrent, Azureus Vuze, and eMule.
Original Press Release:
ATC Releases Updated P2P Marshal, Now with eMule Support
ITHACA, N.Y. -- ATC-NY has just released Version 3.1.0 of P2P Marshal(TM). P2P Marshal is a computer forensics tool which automatically detects, extracts and analyzes P2P evidence on hard drives. A typical data acquisition and analysis taking hours by hand runs in a few minutes with P2P Marshal.
The tool comes in two editions:
-- P2P Marshal Forensic Edition(TM) - The "software only" edition installs and runs on an investigator's workstation to analyze a mounted disk image.
-- P2P Marshal Field Edition(TM) - This edition comes on and runs from a USB drive. It can conduct live investigations as well as analyze mounted disk images. Field Edition allows an investigator to go mobile as the USB drive may be moved from computer to computer; no installation is required. This allows an investigator to conduct forensic searches out in the field, offering freedom of movement and capabilities on a target computer where P2P Marshal can investigate that computer's hard drive.
P2P Marshal automatically detects and analyzes peer-to-peer file sharing usage including the most commonly used P2P client programs such as Ares, BitTorrent, Frostwire, LimeWire, uTorrent and Azureus Vuze. The updated version adds support for eMule.
P2P Marshal presents per-user information on those clients, including shared files, downloaded files, peer servers and configuration and log information. P2P Marshal performs these tasks in a forensically valid way and presents the results in an easily readable form on screen and can produce reports in CSV, RTF, PDF and HTML formats.
Images can be quickly reviewed with P2P Marshal's thumbnail browser. It's fast!
ATC-NY developed P2P Marshal in conjunction with the National Institute of Justice. For information about the products, visit www.p2pmarshal.com
ATC-NY offers a one-day course in peer-to-peer forensics and P2P Marshal. Contact training@p2pmarshal.com for information about course locations and dates.
P2P Marshal is currently being used by local, state, federal and international law enforcement to investigate cyber crimes. Without automated tools, a forensic investigator's job to find evidence of illegal file sharing and distribution is manually intensive and time-consuming. P2P Marshal greatly helps investigators reduce the time required for the analysis process. The tool is also useful to private corporations for compliance checking. A company that prohibits peer-to-peer software on its corporate systems could use P2P Marshal to confirm such compliance.
ABOUT ATC-NY. Located in Ithaca, NY, ATC-NY conducts advanced research and development in computer security and information assurance. ATC-NY is a subsidiary of Architecture Technology Corporation (ATC), headquartered in Eden Prairie, MN. Founded in 1981, ATC specializes in software-intensive solutions for complex problems in information security, enterprise-scale network computing architectures, and network management. ATC's customers include firms in the private sector and government agencies such as the U.S. Department of Defense, Homeland Security and Transportation.
