Gnutella, eMule, and Ares Investigations

Before BitTorrent became dominant, file-sharing networks such as Gnutella (used by programs like LimeWire), eDonkey and Kad (used by eMule), and Ares were widely used to search for and trade files. These networks are far less popular than they once were, but they still operate, and law enforcement has monitored them for years. This page gives general background on these networks and how investigations involving them often happen.

Background and History of Gnutella, eMule, and Ares

Gnutella was released in 2000 by developers at Nullsoft and became the basis for programs such as LimeWire, BearShare, Shareaza, and FrostWire. LimeWire was shut down in 2010 after a court ruling in a copyright lawsuit. eMule, an open-source program for the eDonkey and Kad networks, was launched in 2002. Ares Galaxy, also released in the early 2000s, used its own network. Many of these programs are no longer actively developed, though some remain available.

Gnutella, eMule, and Ares Features and Services

Unlike BitTorrent, these networks typically let users type search terms and see a list of matching files from other users. Files are usually identified by hash values, and many programs share a user’s downloaded files automatically from a shared folder. The search terms a user enters, the names of files in a shared folder, and the program’s own settings and logs can all become evidence.

How People Use Gnutella, eMule, and Ares

These networks were among the first to let ordinary computer users share files directly with one another, and they helped pioneer the peer-to-peer technology now used in many lawful applications. Their programs have been used to share freely licensed music, open-source software, public-domain works, and personal files.

How Many People Use Gnutella, eMule, and Ares?

We did not locate any reliable current user counts for Gnutella, eMule, or Ares. All three are generally understood to have far fewer users today than at their peak in the 2000s.

How Investigations Involving Gnutella, eMule, and Ares Often Begin

Peer-to-peer investigations work differently from investigations of social media or messaging apps. There is usually no company in the middle that detects files and reports them. Instead, law enforcement officers often connect to the network themselves using software built for investigations, look for users offering files whose hash values match known illegal material, record the IP address of the computer sharing the files, and sometimes download files directly from that single source. The officer then typically sends a subpoena to the internet provider for that IP address to learn the subscriber’s name and address, and seeks a search warrant for the home. The firm’s article on P2P investigations explains this process in more detail.

Where the Evidence Comes From in Peer-to-Peer Cases

As with other peer-to-peer networks, there is no company that holds account records for most users of these networks. Evidence usually comes from the investigator’s software logs, internet provider subscriber records, and devices seized in a search, including the file-sharing program’s settings, shared folders, and search history.

Connecting an IP Address to a Person

In peer-to-peer cases, the internet subscriber whose name comes back on a subpoena is not necessarily the person who used the file-sharing software. Households share connections, Wi-Fi can be used by guests or neighbors, and some software runs in the background and shares files automatically. Questions about whether files were actually viewed, whether a person knew a program was sharing them, and how investigative software recorded and verified a download can all matter. See also questioning the biography of a digital file.

Examples From Reported Cases

The examples below are drawn from public announcements and news reports. They are described generally and without names. Charges are only accusations, and anyone charged is presumed innocent unless proven guilty in court. These summaries are not a prediction of how any other case will turn out.

• In 2016, a multi-year Internet Crimes Against Children task force operation in the Los Angeles area led to arrests of men accused of using file-sharing programs including Ares, LimeWire, BitTorrent, and GigaTribe. In one case, investigators alleged that a man had used internet connections at several workplaces. The charges were allegations at the time of the announcement.
• In Nebraska, a state investigator downloaded files directly from a suspect IP address during a peer-to-peer undercover operation in 2024. A subpoena to the provider identified the subscriber, and a search warrant followed. The man was sentenced in federal court in 2025. The announcement did not name the specific network or program.

Related Articles on InternetCrime.com

• Platform Investigations: all platforms
• Peer-to-Peer (P2P) Investigations
• Child Pornography Defense
• Possession Charges
• Distribution Charges
• Questioning the Biography of a Digital File
• When the Government Fails to Preserve Digital Evidence

If You Are Under Investigation Involving Gnutella, eMule, and Ares

If police have contacted you, if a search warrant has been served, or if you believe an investigation involving a Gnutella, eMule, and Ares account may be underway, it is important to get legal advice before taking any action on your own. Attorney Ron Frey generally advises speaking with an attorney before answering questions or agreeing to a search. Whether a person may be required to provide a password or unlock a device depends on the circumstances, the jurisdiction, and any search warrant or court order involved, so that decision should be made with an attorney’s advice (see should I provide my password to the police or FBI?).

You have the right to remain silent. Anyone accused of a crime is presumed innocent unless proven guilty in court. Laws change and vary from state to state and between state and federal court, and the way they apply depends on the specific facts. Please don’t rely on the internet or on AI tools to evaluate your situation. Every case is different, and contacting an attorney is a priority to get tailored advice.

Attorney Ron Frey of The Frey Law Firm, LLC has been practicing law for over two decades and represents people nationally in internet and computer crime investigations and charges. He is a conference speaker and published author.

Attorney Ron Frey Is Available for a Free Initial Confidential Consultation: Call or Text (844) 766-3739. In Florida, call (813) 775-2276. You can also reach the firm through the contact page.

References

• U.S. Immigration and Customs Enforcement, Operation Wide Net press release (Apr. 2016)
• U.S. Attorney’s Office, District of Nebraska, press release (Mar. 2025)
• Wikipedia, “Gnutella” (background)
• Wikipedia, “eMule” (background)

Important: This page provides general information only. It is not legal advice, and it is not a complete or current statement of the law or of any company’s policies. Laws, court decisions, and platform practices change, and their effect depends on the facts of each case and on how courts interpret them. User figures and report counts come from the sources listed and may since have changed. Platform names and logos are trademarks of their owners and are used only to identify the services discussed; The Frey Law Firm, LLC is not affiliated with or endorsed by any of these companies. Please don’t rely on this page, or on any other information online, to make decisions about your situation. Talk with a lawyer. Reading this page or contacting The Frey Law Firm, LLC does not create an attorney-client relationship. Last reviewed: October 26, 2026.