Evidence present within ‘shared’ and ’incomplete’ are as a result of Limewire peer to peer activity. When installed, Limewire creates folder entries in several locations, most notable being :-
Documents and Settings\Username\.limewire Documents and Settings\Username\Incomplete Documents and Settings\Username\Shared and Program Files\Limewire
When a file is selected to be downloaded it is first placed within ‘Incomplete’ folder and the filename takes the form :-
When the download is complete the file is moved to the ‘shared’ folder and the filename drops the T-###... notation.
During download, a file entitled downloads.dat keeps a record of all files being downloaded using Limewire. If a file is present within the ‘Incomplete’ folder then it is indicative that the file has not completed download. There are many reasons why a file may not have completed downloading, for example, the user may have intervened and stopped the process, or the user sharing the file may have gone off line. Once a download is complete the file is placed inside the ‘shared’ folder. The ‘shared’ folder is the default location for sharing of files across the Limewire network. When first installed, this folder is shared, permitting uploading of material from ones hard drive. It is possible to turn off sharing so no files can be uploaded. It is also possible to designate other folders to share.