# Project Maelstrom: Forensic Analysis of the BitTorrent-Powered Browser

## Full Text

This Markdown is an automated text extraction for search and reading tools. The [hosted PDF](ProjectMaelstrom.pdf) is the authoritative publication source.

Source PDF: [ProjectMaelstrom.pdf](ProjectMaelstrom.pdf)
Source SHA-256: `901d9453d4b913592190490637d6e04eb252e342357ac3c879d7e5f6aff8bae5`
Generated with `pdftotext -nopgbrk`; formatting and reading order may differ from the PDF.

---

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

JDFSL V10N4

PROJECT MAELSTROM: FORENSIC
ANALYSIS OF THE
BITTORRENT-POWERED BROWSER
Jason Farina, M-Tahar Kechadi, Mark Scanlon

School of Computer Science, University College Dublin, Ireland.
jason.farina@ucdconnect.ie, {tahar.kechadi, mark.scanlon}@ucd.ie

ABSTRACT
In April 2015, BitTorrent Inc.

released their distributed peer-to-peer powered browser,

Project Maelstrom, into public beta. The browser facilitates a new alternative website distribution paradigm to the traditional HTTP-based, client-server model. This decentralised
web is powered by each of the visitors accessing each Maelstrom hosted website. Each user
shares their copy of the website;s source code and multimedia content with new visitors.
As a result, a Maelstrom hosted website cannot be taken oine by law enforcement or any
other parties. Due to this open distribution model, a number of interesting censorship, security and privacy considerations are raised. This paper explores the application, its protocol,
sharing Maelstrom content and its new visitor powered web-hosting paradigm.
Keywords:

Project Maelstrom, BitTorrent, decentralised web, alternative web, browser

forensics

1.

INTRODUCTION

Project Maelstrom was released as a private
alpha in December 2014 [Klinker, 2014] and
as a public beta in April 2015 [Klinker, 2015].
Its purpose is to provide a decentralised web

as:

Truly an Internet powered by people, one that lowers barriers and
denies gatekeepers their grip on our
future [Klinker, 2014].

ecosystem facilitating a new parallel to the

While the topic of BitTorrent in the media

existing world wide web.

Through this de-

seems to predominantly coincide with a dis-

centralisation, users are free to create and

cussion on online piracy [Choi and Perez,

share any content they desire without the

2007], the protocol has proven itself as a ro-

need for web hosting providers or domain

bust, low-cost, distributed alternative to the

names, and can bypass any national or in-

traditional client-server content distribution

ternational censorship.

The HTML docu-

model. From a forensic standpoint, the de-

ments, associated styling and scripting les,

centralised nature of BitTorrent based appli-

multimedia content, etc., are hosted by the

cations can result in extended windows for

website's visitors, and subsequently served

evidence acquisition [Scanlon et al., 2014].

to other visitors accessing the site. The of-

Aside from facilitating copyright infringe-

cial BitTorrent blog celebrated its arrival

ment, a number of additional online services

© 2015 ADFSL

Page 115

JDFSL V10N4

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

2.

have been developed using the protocol in-

BACKGROUND

cluding:

READING

ˆ File Synchronisation Service  BitTor-

2.1

Peer-to-Peer Facilitated
Web Browsing

rent Sync is a cloudless alternative to
le

The deep web refers to layers of Internet ser-

synchronisation services such as Drop-

vices and communication that is not readily

box, OneDrive, iCloud, etc.

[Scanlon

accessible to most users and is not crawlable

et al., 2015]. With a standard BitTor-

by traditional search engines. Unlike the reg-

rent Sync install, users are not limited

ular Internet, there is not one set of pro-

in the amount of data they can share as

tocols or formats for the deep web, instead

there are no replicated server-side limi-

deep web is a generic term used to describe

tations.

Internet communications that are managed

the

cloud-based,

multiple-device,

ˆ Cost-Eective

Commercial

Distribution

BitTorrent

Content

using closed or somehow restricted proto-

use

cols. More recently however, the term deep

the protocol to distribute commercial

web has been made synonymous with black-

multimedia

their

market sites such as The Silk Road, taken

Large

oine by the FBI in 2013. While BitTorrent



content

BitTorrent Bundle

Inc.

through
oering.

video game creators and distribution

Inc.

companies, Blizzard Entertainment and

enhances privacy or anonymises a user's In-

Valve have used the BitTorrent proto-

ternet trac, many of the competing decen-

col to distribute installation les and

tralised deep web technologies focus their ef-

software patches to their users [Watters

forts on precisely that.

et al., 2011].

The advantage for these

companies is that the protocol excels
where

the

traditional

client-server

do not claim that Project Maelstrom

2.1.1

The Freenet Project

The Freenet project is a peer based dis-

model starts to fail; the more users, the

tributed Internet alternative.

faster the average download speed.

nect to Freenet through an installed appli-

Users con-

cation that uses multiple encrypted connections to mask the identifying network in-

1.1

Contribution of this Work

formation and the data location.

Freenet

peers, or nodes, store fragments of data in
a distributed fashion. The number of times

The contribution of this work can be sum-

a data item is replicated is dependent on

marised as:

the demand for that data.

More popular

les have more available sources resulting
in better availability and faster access times

ˆ An overview and analysis of Project
Maelstrom's functionality.

ˆ An analysis of the forensic value of its
installation and conguration les.

ˆ An investigation of evidence left behind

for the requester.

The layered encryption

of the connections provides an eective defence against network sning attacks and
also complicates network forensic analysis.
Freenet, by default, is deployed as an Open-

after uninstallation and what knowledge

Net service.

be recovered.

enumerate and connect to all available nodes

Page 116

On OpenNet, it is possible to

© 2015 ADFSL

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

JDFSL V10N4

and perform trac correlation to trace back
to the original requester [Roos et al., 2014].

2.1.2

Tor

Tor (The Onion Router) is a networking protocol designed to provide anonymity while
accessing both regular websites, and those
hosted within the Tor network. Initially, Tor
provided random internal encrypted routes
enabling anonymised regular website access
for its users.

This was achieved through a

minimum of three encrypted connections be-

Figure 1.

fore exiting to the regular Internet through

Page

Project Maelstrom Default Start

an exit node.
2.1.3

A user can opt not to utilise an exit
node and instead browse content on services hosted within the Tor network itself.
These Tor websites are known as Hidden
Services (HS) and the identity and geolocation of the hosting server are obfuscated, in
a similar fashion to the website's visitors.
This anonymisation would normally make
any form of dependable routing impossible
as any DNS lookup would not be able to report a static IP address for the service for the
client system to connect to. Instead, hidden
services use a distributed hash table (DHT)
and a known service advertising node to inform clients of their presence and the path
to the service provided.

I2P

The Invisible Internet Project (I2P) is often considered another anonymisation utility
like TOR. However, its garlic routing protocol is intended to create an alternative Internet. In this model, all trac takes place
via unidirectional tunnels established out to
a resource which responds with its own, different, tunnelled return path.

In this way

all trac to and from a host is protected by
a separate session based tunnel that closely
resembles that of TOR, but I2P was not intended to allow access to sites or services
outside of the I2P network itself. In this regard, I2P more closely resembles Tor Hidden
Services. In I2P, the trac is encrypted end-

Due to the reliance of the HS on DHT

to-end and the encryption in either direction

and directory servers to perform the intro-

is handled separately [Zantout and Haraty,

ductions for Tor users, Biryukov et al. [2013]

2011].

were able to demonstrate a denial of service
attack on a HS by impersonating the directory servers.

They were also able to crawl

the DHT to harvest Onion Identiers over a
period of two days, resulting in an accurate
index of the content of the deep web contained within Tor. This approach could be

3.

PROJECT

MAELSTROM:
APPLICATION
ANALYSIS

useful when attempting to stall a HS until it

Project Maelstrom is built upon the open

can be properly identied.

source version of Google's Chrome browser,

© 2015 ADFSL

Page 117

JDFSL V10N4

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

tracker.publicbt.com, and
https://s3-us-east-1-elb.amazonaws
.com.

Chromium, as can be seen in Figure 1.

3.1

Installation

The version of Project Maelstrom analysed
as

part

of

this

paper

has

the

following

properties

The

rst

URL

router.bittorrent.com
registration

point

contacted

which
for

acts

the

is
as

client

a

and

File: Maelstrom.exe
a way to initiate DHT participation.
Size: 36,971KB
update.browser.bittorrent.com
runs
MD5: d3b6560c997a37a1359721fdaa25925f
a script on connection which checks the
SHA1: 9de7c48e324b2ac9240ca168b7c2afd46bd1c799
version of the client connecting and genOrigin: download-lb.utorrent.com
erates a redirect to download the relevant
version: 37.0.2.1
update if applicable. The update check is
All testing was carried out on a virtual
triggered when the local client sends a GET
machine running Windows 7 with 1GB ram
/windows/latest.json request and, if an
and a thin provisioned 60gb hard drive.

update is required the response contains a

The Project Maelstrom installation pro-

URL http://update.browser.bittorrent

browser based on Chrome that acts as a user

.com/windows/<latestversionnumber>/
mini_installer.exe. This secondary in-

interface for the Maelstrom network.

The

staller silently deploys a new folder alongside

second is the BitTorrent Maelstrom appli-

the original version with the new version

cation that handles caching of torrents and

number and the preferences and path les

maintains connection to the distributed hash

are updated accordingly.

cess is in two parts. The rst part installs a

table (dht).

As

Once executed,
installer

installa-

\Local\Maelstrom\Application\<version
number>\Installer.
are

extracted

from

installation

URLs

stored

used

within

the

maelstrom.exe (desktop shortcut target)

MD5:

44d2641129cc922c5bc3545db8c8cda7

chrome.native.torrent.exe(browser

MD5:

85871a540cd77a3c419658fbe21c682b

These executables are copies of les stored

during

in-

settings

les

in the <version> subfolder and any update

package

will cause the current les to be renamed

Chrome.7z

with a prex of old_

through standard DNS queries. This allows

placed with

source

without

servers

to

invalidating

packages.

The

cic

at

URLs

change
older

Project

the

time

addresses
installation

before being re-

the later version.

VisualElementsManifest.xml

The

le

contains

references to logos and other application

Maelstrom

spe-

images that include the <version> number

of

are:

to

writing

https://s3-us-west-1.amazonaws.com,
router.bittorrent.com,
update.browser.bittorrent.com,
router.utorrent.com,
bench.utorrent.com,
tracker.openbittorrent.com,
Page 118

torrent

manager)

and IP addresses are resolved as required
the

procedure

ecutables to the \Application\ directory:

required

setup.exe are stored in a directory created at

pre-dened

the

the

extracts

TEMP directory in \Users
\<username> \Appdata. Chrome.7z and

All

of

Project Maelstrom installs the following ex-

tion les to a

stallation

part

the Project Maelstrom

indicate

which

is

the

current

active

subfolder though unless manually altered
this will usually indicate the latest version
installed.
The

subfolder

\Application\<version>\webui

con-

tains the base les for displaying default

© 2015 ADFSL

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

JDFSL V10N4

Chromium fonts, backgrounds, borders as

torrent data from the users system without

well as all the les necessary for the start

any visible indicator. In testing the data rate

page and the index.html and images for the

was observed to maintain at an average 800

Project Maelstrom onboarding homepage

bytes per second up and 800 bytes per sec-

partly depicted in gure1

ond down.

In addition to the Application folder

This was most likely just DHT

updates and ping trac. At any given time

AppData\Local\Maelstrom\User Data\ is

there were approximately 50 concurrent con-

provisioned to store user specic data includ-

nections recorded.

ing user preferences, browser and torrent settings and browsing history. The majority of

The Project Maelstrom specic settings

les are stored in the Default folder which

can be found in the Torrent section of the

contains a subset of the standard Chrome in-

settings page. Each settings is customisable

stallation les in addition to les specic to

but at the time of installation the defaults

Project Maelstrom.

are:

These will be covered

in section 3.3 with the other les of forensic

ˆ Cache Size  The amount of space avail-

value to an investigator.
The second part of the installation in-

BitTorrent
Maelstrom folder in \Users \<username>
\Appdata\Roaming\ to handle all torrent
volves the deployment of the

and

DHT

related

activities.

Any

able to store cached torrent data is set
to 5GB with a warning not to exceed
100GB.

ˆ Sharing Ratio  A slider can be used to

new

change the ratio from 0 upload to unlim-

torrents requested are saved here along with

ited upload. The default setting is up-

the corresponding .resume le. Torrent con-

load data is equal to the amount down-

tent is stored in the cache folder to speed
up future access to to act as a repository
to be shared with other users.

loaded. This sharing ratio is measured
on a per torrent basis and is presented

On instal-

to the user as a measure of contribution.

lation the root folder is used to store the les

ˆ Rate Limits  The default setting is to

8E65684D700ECC41A09A60EE58991845EA56F734.resume

not restrict upload or download speeds.

8E65684D700ECC41A09A60EE58991845EA56F734.torrent

ˆ Transfer Limit  The default setting is

which are the torrent les associated with

not to impose a cap on total transfer

the Project Maelstrom Startpage.

3.2

amounts.

ˆ Port Settings  A port is selected at in-

Settings

stallation as the static communication

Being built on Chromium, Project Mael-

port.

strom has all of the same browsing op-

tomised here or can be set to be ran-

tions

available

dard

installation

defaults

set

stallation.
found in

> System.

as

to

the
has

a

user.
the

A

same

domly selected.

ˆ Proxy Server  The proxy settings for

Chrome

in-

torrent transfers can be selected from a

interest

is

dropdown list including SOCKS which

Settings > Advanced Settings

will allow for the use of TOR for added

The option to continue run-

anonymity. By default, no proxy is se-

One

standard

stan-

browser

This port number can be cus-

setting

of

ning background apps when Maelstrom is
closed is enabled by default.

This will re-

sult in the chrome.native.torrent.exe executable running and sharing cached website

© 2015 ADFSL

lected.

ˆ Privacy  By default the option to send
anonymous crash data to BitTorrent
Inc. is enabled.

Page 119

JDFSL V10N4

3.3

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

Files of Forensic value

bundle.
2. Origin Bound Certs will only con-

During

the

rst

run

the

preferences les stored in

settings

and

tain the certicates specic to the

User Data and

Application are populated.

normal internet browsing activi-

at the same

ties.

time, the torrent specic settings and dis-

3. The

covery

are

rectory.

recorded

in

the

Roaming

di-

scripts

Because of Project Maelstrom's

in

roots in the Chromium browser, many of
the same forensically important resources
are present.

However, the dual nature of

the utility does present some degree of difference.For example, while the History tab
shows the
sites
is

not

stored

data les.

the

content

in

the

for

standard

these

been

Cache
the

run

after

is

stored

directory.

for

full

of

HTML

tent information used by visited
websites.

From the rst run this

will contain the Unique ID used

or

by bench.utorrent.com to gather

Instead checking the output of

anonymous usage statistics.

about:cache in the browser will only show

The

contents of this folder are SQLite3

standard website les. All caching and man-

databases with individual data sets

agement relating to torrents are stored in the

Roaming\BitTorrent Maelstrom folder.
ˆ Local\Maelstrom\Application  This

rendered

bittorrent://welcome is stored
as part of f_000005.
4. Local Storage  contains persis-

sites

caches

have

the

example,

bittorrent:// and magnet://

visited,

HTML

stored as blobs
5.

Session Storage  contains a list
of BitTorrent UUIDs.

The rst

UUID matches that stored in the

directory contains initial setup les and
Of

bench.utorrent local storage le.

most use is conrmation of an active

The remainder are those of remote

installation, timestamps to indicate in-

peers the browser is in contact

stall time and a record of the initial set-

with.

content added during installation.

tings.

ˆ Local\Maelstrom\User Data

ˆ Roaming\BitTorrent Maelstrom\

con-

Contains the bulk of the torrent han-

tains the majority of the user specic

dling and storage elements of Project

settings

Maelstrom.

and

activity

records.



This

folder and its subfolders can be examined using established forensic tech-

The root folder has many

items of forensic value including:
1.

<bt.infohash>.torrent
le

used

to



The

locate

and

niques for use on Chrome browsers but

torrent

also includes some new les that may be

download

of use.

This is a standard torrent le for-

resources

from

peers.

1. The history SQLite3 database le

mat listing all sub-les contained

stored in the

default folder will
magnet:? URI
and the resolved bittorrent://
address. The magnet:? entry will

within the bundle and the hashes

contain both the

for each piece and the trackers.

Page 120

2.

<bt.infohash>.resume  A resume le created to allow .tor-

have a title (same as the torrent

rent data processing to be paused

le), while the bittorrent:// ad-

and continued without having to

dress will have the title of the

restart to ensure full data trans-

index.html page contained in the

fer.

The creation of the resume

© 2015 ADFSL

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

3.

le could be used as a guideline to

AppData\Local\Maelstrom\User Data\ is

when the related .torrent was rst

left intact including any history and cookie

processed.

folders as well as user specic settings and

dht.dat  This consists of a ben-

preferences.

coded list of observed IP:Port com-

If

the

binations of peers participating in

tory

is

the DHT. The content starts with

AppData\Local\Maelstrom\ folder and all

the value id20:, which is followed
by the BitTorrent client's unique

4.

JDFSL V10N4

option

to

selected

remove
then

User
the

hisentire

subfolders are removed. However, in either
scenario the AppData\Roaming\BitTorrent

ID on the DHT network. It is then

Maelstrom\ folder is left untouched along

followed by the number of observed

with all of the subfolders and les con-

nodes or peers and a listing of the

tained therein including

IP:Port pairs in 6 byte IPv4 repre-

.torrent and .resume les that may have

sentations.

been stored.

settings.dat  This le contains
the torrent client settings and the

dht.dat and any

Additionally all cached data

held in the cache directory is left intact and
retrievable.

usage statistics.
5.

Cache  This stores the downloaded torrent les, which corre-

4.

spond to the name of the torrent
appended with the btinfohash of
the piece.
are

MAELSTROM:

Scripts and web pages

loaded

and

executed

from

PROJECT

PROTOCOL ANALYSIS

this directory to improve browsing
speed for the user and to provide a
repository to share to other peers.
6.

4.1

Accessing a Website

trusted folder  This stores the
bittorrent.crt le for use in

Project Maelstrom supports all of the reg-

peer secure transfer negotiation.

URIs; bittorrent:// and magnet:?.

3.4

Local File Remnants

ular protocols that ship with Chromium,
alongside two BitTorrent ecosystem specic

In order to load any given webpage, the

While there is no dedicated uninstall executable for Project Maelstrom, the registry
key

browser must:
1. Resolve the magnet link to a .torrent

HKCU\<user>\Software\Microsoft\Windows\
CurrentVersion\Uninstall\Maelstrom
UninstallString

2. Identify other peers currently serving

shows the control panel remove program

3. Identify any torrents contained within

AppData\Local\Maelstrom\Application\
<version> \Installer\setup.exe
−−uninstall
default

the

option

history

is

not

checked.

fault,

all

of

the

© 2015 ADFSL

les

to

that webpage.
the webpage bundle.

options to be the equivalent of running

By

le.

4. Cache

part

les

and

store

them

as

blocks of the whole in sequence.
5. Process any scripts that determine content.

remove

user

left

as

de-

6. Update the sharing status of the local

folders

in

content to include the new webpage.

If
and

Page 121

JDFSL V10N4

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

4.1.1

uploading of content to a web server. These

Peer Discovery

In order to discover an initial set of peers the
client

contacts

router.bittorrent.com.

The packet requesting peers contains the
command

nd_nodes

and

is

bencoded

with the Local Peer ID followed by the BitTorrent share ID. In response a bencoded
list of registered peers is returned, each with
a 26 byte entry consisting of a 20 byte
PeerID and a 6 byte IP:Port entry. The local
client then uses DHT_Ping to discover live
hosts and standard torrent discovery is per-

websites can be delivered either as a single
large torrent resource broken into pieces or,
for ease of maintenance and to avoid users
having to re-download the entire site every time the content is changed, as a series
of .torrent les linked by an encompassing
Bundle.
To make the process more streamlined,
BitTorrent Inc. have developed a number of
helper tools and guidelines [BitTorrent Inc.,
2015].

formed as described in the BitTorrent Exten-

5.

sion Protocols (BEP)  specically BEP005
deals with DHT discovery and bootstrapping
[Loewenstern and Norberg, 2008]. Any peer
that has the

chrome.native.torrent.exe

executable running, even if the Maelstrom
browser is shutdown, that has the torrent in
its cache will become available as valid content source.
4.1.2

Content Negotiation

envisioned

that

Maelstrom

the

(and

popularity
similar

of

decen-

tralised alternatives) will increase in the
coming months and years due to its ease of
use, easy web-authoring and zero-cost model
(to content creators and consumers alike).
ity to raise their new Internet from the deep

ther as torrent les or as magnet:?

links.

If

Mael-

magnet

is

Project

Perhaps BitTorrent Inc. will have the abil-

Links in Project Maelstrom are handled eia

It

CONCLUSION

link

is

followed

the

web into the hands of regular Internet users.

5.1

Future Work

strom browser must rst resolve the data

With the browser just having been recently

provided

released as a public beta,

in

the

link

to

a

valid

torrent

there remains

This is achieved either by looking

much to be discovered regarding the nuances

up the tracker URL included in the mag-

of this decentralised web. Some areas for fu-

le.

net link using the

tr parameter or one

of the default trackers dened at installation.

Once discovered the torrent ID is

ture work include:

ˆ Development of a tool capable of monitoring who is accessing any specic

then used to construct find_nodes requests

Maelstrom-only website.

that are sent to the known DHT peers and

tralised nature of the protocol leaves

router.bittorrent.com.

it vulnerable for third-parties to garner

4.2

Maelstrom Development

The decen-

visitor information statistics that are
normally reserved for the administrator

The development of websites for distribu-

of the web host such as location, access

tion through Maelstrom does not require

duration, les downloaded, frequency of

any special consideration during the develop-

repeat visits, content available for shar-

ment of the website content, i.e., the HTML,

ing, etc.

CSS, JavaScript, graphics, multimedia con-

ˆ Perform an analysis of ZeroNet [Ze-

tent, etc. Where the traditional web devel-

roNet, 2015], an open source Project

opment process diers is with regards to the

Maelstrom alternative.

Page 122

ZeroNet does

© 2015 ADFSL

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

JDFSL V10N4

not require the use of a specic browser
 instead running as a service on the local machine.

© 2015 ADFSL

Page 123

JDFSL V10N4

Project Maelstrom: Forensic Analysis of the BitTorrent-Powered ...

Journal of
Digital Forensics, Security and Law, pages
Study on BitTorrent Sync.

REFERENCES
Alex Biryukov, Ivan Pustogarov, and Ralf-

8599, 2014.

Philipp Weinmann. Trawling for tor hidden

services:

Detection,

measurement,

Proceedings of the
2013 IEEE Symposium on Security and
Privacy, pages 8094, 2013.
deanonymization.

BitTorrent

Inc.

In

Torrent

Web

Tools.

https://github.com/bittorrent/
torrent-web-tools, May 2015.

Mark Scanlon, Jason Farina, and M-Tahar
Kechadi. Network Investigation Methodology for BitTorrent Sync: A Peer-to-Peer
Based File Synchronisation Service.

puters & Security, 2015.

Com-

http://dx.doi

.org/10.1016/j.cose.2015.05.003.
Paul

A.

Watters,

Robert

Layton,

and

Richard Dazeley. How much material on
David Y Choi and Arturo Perez.

Online

piracy, innovation, and legitimate business models.

Technovation, 27(4):168178,

2007.

BitTorrent is infringing content?
study.

A case

Information Security Technical Re-

port, 16(2):79  87, 2011.

Bassam Zantout and Ramzi Haraty. I2p data
Eric

Klinker.

The

Project

Internet

We

Maelstrom:

Build

Next.

http://blog.bittorrent.com/
2014/12/10/project-maelstrom-the
-internet-we-build-next/, December
2014.
Eric Klinker.

ICN 2011, The
Tenth International Conference on Networks, pages 401409, 2011.
communication system. In

https://github.com/
HelloZeroNet/ZeroNet, May 2015.

ZeroNet.

Project Maelstrom Enters

http://blog.bittorrent.com/
2015/04/10/project-maelstrom
-enters-beta/, April 2015.
Beta.

Andrew Loewenstern and Arvid Norberg.
DHT Protocol.

http://www.bittorrent.org/beps/
bep_0005.html, 2008. [Online; accessed
July 2015].
Stefanie

Roos,

Benjamin

Schiller,

Hacker, and Thorsten Strufe.

Stefan

Measuring

freenet in the wild: Censorship-resilience

In Privacy Enhancing Technologies, pages 263282. Springer,

under observation.
2014.
Mark

Scanlon,

Jason

Farina,

Nhien-An

Le Khac, and M-Tahar Kechadi.

Lever-

aging Decentralisation to Extend the Digital Evidence Acquisition Window: Case

Page 124

© 2015 ADFSL