newsMobius Forensic Toolkit - News

 
 

Mobius Forensic Toolkit v2.14 Released: CMake Migration and New eMule Extension

Item posted by Eduardo Aguiar <aguiar> on Thu 01 May 2025 12:25:35 PM UTC.

Hi,

Mobius Forensic Toolkit v2.14 has been released. This release includes extensive refactoring and modernization efforts, such as:

  - Extensions CMake Migration – All extensions have been transitioned from Autotools to CMake, improving build efficiency and cross-platform compatibility.
  - New eMule Forensic C++ Extension – Introducing the app-emule extension, providing specialized tools for analyzing eMule P2P artifacts.
  - All C++ Extensions' Source files renamed from .h/.cc to .hpp/.cpp for consistency.
  - Removed legacy modules (benchmark, unittest, mobius::app, pymobius.p2p).
  - Updated Doxygen tags to use @ syntax for better documentation.
  - Python modules now properly registered in sys.modules.

The new app-emule C++ extension provides deep forensic analysis of eMule client artifacts, handling:

Decoded Files:

  - AC_SearchStrings.dat (AutoComplete search history)
  - storedsearches.met (Saved search queries)
  - known.met (Known file hashes)
  - .part.met and .part.met.txtsrc (Partial downloads metadata)
  - cancelled.met (Cancelled downloads)
  - preferences.dat / preferences.ini (User settings)
  - statistics.ini / statbkup.ini (Download/upload stats)
  - key_index.dat (Kademlia network keys)

Retrieved Evidences:

  - Autofill data (Search history, auto-completed queries)
  - Local and shared files (User-hosted content)
  - P2P remote files (Shared by other peers)
  - Received and sent files (Transfer logs)
  - User account details (Client configuration and activity)

You can download this release at https://www.no ... u.org/mobiusft.

Please, visit our Github repository at: https://github.co ... uiar-oss/mobiusft.

Back to the top

Powered by Savane 3.16.
Corresponding source code