Hi Guys, Is it possible to extract the files that are transferred captured under the XMPP/XML Protocol? I am able to see the filename and size, but i have no idea how to extract/rebuild the image. Here is the PCAP if you any of you are willing to help. Forensic Analysis - PCAP File Kind Regards, Sen |
Yes. Description based on Wireshark 1.12.7. As there are only JPEGs in your pcap file, the following description is related to JPEG files (see remove bytes at the beginning of the file!). Step #1: Follow the TCP stream.
Step #2: right click any frame and select "Follow TCP Stream" Step #7: save the file Hint: 'save as' in the pop-up of 'Follow TCP stream' in 1.99.x somehow cripples the file, so don't use 1.99.x! Regards Hey Kurt, Thanks for your help! Sen
(13 Oct '15, 01:40)
sentral
You're welcome!
(13 Oct '15, 04:57)
Kurt Knochner ♦
|