> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/data-analysis/network-stream-analysis/trick-0306.md).

# Extract File Transfer Details from PCAP Stream

***

To identify files transferred and their intended destination paths from a network capture (PCAP), analyze the relevant streams.

In network analysis tools like Wireshark or Brim, locate traffic associated with file transfers (e.g., HTTP GET/POST). Right-click a relevant packet and select "Follow TCP Stream" or "Follow HTTP Stream".

Manually inspect the reconstructed stream data. Look for filenames and any application-layer data (like commands or configurations within the protocol) that might indicate the target path on the destination system. Examples of paths found by inspecting streams might include: `C:\ProgramData\001\arab.bin`, `C:\ProgramData\001\arab.exe`, `C:\ProgramData\Local\Google\rebol-view-278-3-1.exe`, `C:\ProgramData\Local\Google\exemple.rb`.

While tools can extract files automatically, stream inspection is crucial for finding path details embedded within the data flow.

In Wireshark, the "Follow TCP Stream" feature reconstructs the TCP conversation and displays the data exchanged between the two endpoints. This can be saved in various formats. To save the entire stream as raw data, you can use the "Save as" option within the "Follow TCP Stream" dialog. The available formats include ASCII, EBCDIC, Hex Dump, C Arrays, Raw, and Print. Saving as `Raw` will save the packets displayed.

Alternatively, you can use command-line tools like `tshark` to extract streams programmatically. For example, to extract raw data from a specific TCP stream (e.g., stream index 0) and save it to a file:

```bash
tshark -r your_capture.pcap -z follow,tcp,raw,0 > stream0.raw
```

Replace `your_capture.pcap` with your PCAP file and `0` with the desired stream index. The `-z follow,tcp,raw,stream_index` option is specifically designed for this purpose.

In tools like Brim, which integrates `zeek` (formerly `bro`), file extraction can be automated. The `zeek` framework generates logs, including `files.log`, which contains metadata about detected files. You can query this log to identify file transfers. For instance, a query might look like:

```zeek
_path=files
```

This query will show entries from the `files.log`. The `files.log` often contains fields such as `filename`, `mime_type`, `tx_hosts` (transferring hosts), `rx_hosts` (receiving hosts), and `total_bytes`. While `files.log` provides file metadata and source/destination IPs, the exact *destination path* on the receiving system is typically found by manually inspecting the application-layer data within the stream itself, as this detail is often part of the protocol's commands or data structures, not just the file transfer metadata logged by tools like `zeek`.

Therefore, combining automated file identification via tools like Brim/Zeek logs with manual stream analysis in Wireshark or Brim's stream view remains essential for comprehensive analysis, including discovering the intended destination path.