Retracing the Flow of the Stream: Investigating Kodi Streaming Services

TL;DR

This paper presents a method for quickly locating Kodi artifacts across multiple platforms to aid forensic investigations into illegal streaming and content viewing history.

Contribution

It introduces a novel approach to identify Kodi artifacts and viewing history, enhancing forensic capabilities for investigating illegal streaming activities.

Findings

Effective identification of Kodi artifacts on Windows, Android, and Linux.

Ability to recover viewing history and content locations from the Internet.

Supports forensic investigations into illegal streaming and content distribution.

Abstract

Kodi is of one of the world's largest open-source streaming platforms for viewing video content. Easily installed Kodi add-ons facilitate access to online pirated videos and streaming content by facilitating the user to search and view copyrighted videos with a basic level of technical knowledge. In some countries, there have been paid child sexual abuse organizations publishing/streaming child abuse material to an international paying clientele. Open source software used for viewing videos from the Internet, such as Kodi, is being exploited by criminals to conduct their activities. In this paper, we describe a new method to quickly locate Kodi artifacts and gather information for a successful prosecution. We also evaluate our approach on different platforms; Windows, Android and Linux. Our experiments show the file location, artifacts and a history of viewed content including their locations from the Internet. Our approach will serve as a resource to forensic investigators to examine Kodi or similar streaming platforms.