Hi Guys, Is it possible to extract the files that are transferred captured under the XMPP/XML Protocol? I am able to see the filename and size, but i have no idea how to extract/rebuild the image. Here is the PCAP if you any of you are willing to help. Forensic Analysis - PCAP File Kind Regards, Sen asked 12 Oct '15, 01:02 sentral |
One Answer:
Yes. Description based on Wireshark 1.12.7. As there are only JPEGs in your pcap file, the following description is related to JPEG files (see remove bytes at the beginning of the file!). Step #1: Follow the TCP stream.
Step #2: right click any frame and select "Follow TCP Stream" Step #7: save the file Hint: 'save as' in the pop-up of 'Follow TCP stream' in 1.99.x somehow cripples the file, so don't use 1.99.x! Regards answered 12 Oct '15, 15:03 Kurt Knochner ♦ edited 12 Oct '15, 15:05 |
Hey Kurt,
Thanks for your help!
Sen
You're welcome!