Breadcrumbs in the Digital Forest: Tracing Criminals through Torrent Metadata with OSINT

TL;DR

This paper demonstrates how torrent metadata can be leveraged for open-source intelligence to identify high-risk behaviors and illicit activities, providing a scalable method for digital investigations.

Contribution

It introduces a novel OSINT process utilizing torrent metadata, enriched with geolocation and behavioral data, for investigative profiling and threat detection.

Findings

Torrent metadata reveals user clustering and co-download patterns.

Enriched data can identify users involved in illicit content.

The method supports automated, scalable digital investigations.

Abstract

This work investigates the potential of torrent metadata as a source for open-source intelligence (OSINT), with a focus on user profiling and behavioral analysis. While peer-to-peer (P2P) networks such as BitTorrent are well studied with respect to privacy and performance, their metadata is rarely used for investigative purposes. This work presents a proof of concept demonstrating how tracker responses, torrent index data, and enriched IP metadata can reveal patterns associated with high-risk behavior. The research follows a five-step OSINT process: source identification, data collection, enrichment, behavioral analysis, and presentation of the results. Data were collected from The Pirate Bay and UDP trackers, yielding a dataset of more than 60,000 unique IP addresses across 206 popular torrents. The data were enriched with geolocation, anonymization status, and flags of involvement in child exploitation material (CEM). A case study on sensitive e-books shows how such data can help detect possible interest in illicit content. Network analysis highlights peer clustering, co-download patterns, and the use of privacy tools by suspicious users. The study shows that publicly available torrent metadata can support scalable and automated OSINT profiling. This work adds to digital forensics by proposing a new method to extract useful signals from noisy data, with applications in law enforcement, cybersecurity, and threat analysis.