Basically it is a packet sniffer that reassembles HTTP streams, and if a stream contains an image that CrystalBall can decode, it decodes the image and displays it. Basically it lets you spy on others. In other words, it's a Windows version of Etherpeg or Driftnet. It's not as cool as the others, in that it only works on HTTP (web) streams. So that means you won't be able to see your friend FTPing his pr0n collection.
The only option that doesn't work is the "desktop" option. I probably won't get around to it. Send me email if you want that feature and I'll look into it when I have time (haven't had much lately). CrysalBall comes with no warranty. Use at your own risk. There are probably memory leaks. I should probably rewrite the LRU cache.
Note: You will need to download WinPcap in order to use it. You only need the auto-installer version, unless you want to do your own development.
Download the CrystalBall executalbe.
Language: C++
Tools: Visual C++, Platform SDK (WIN32API), WinPcap
Status: semi-active