July 28, 2009 at 3:26 pm #4073VedderParticipant
Can anyone help me recreate files from a packet capture.
I have found a good page on hex headers (http://www.garykessler.net/library/file_sigs.html), and I know that there are at least two bmp images and one zip file.
I have tried copying them all to notepad, then loading them up in a hex editor, and saving them as the required file type, but if I try opening them up in paint, or winzip, I just get a “file is corrupt” message.
Is there a step I am missing?
July 28, 2009 at 3:44 pm #25905
July 28, 2009 at 3:50 pm #25906KetchupParticipant
NetWitness is great, like Don indicated. I’ve used it and it really makes viewing HTML, Email, and other types of documents amazingly easy as they travel across the wire.
Wireshark can also do this, depending on the protocol. Files transmitted through HTTP can be exported using the File, Export, Objects menu. For other protocols, you would have to isolate the packets that belong to your file, and then export the packets. Wireshark will put the fragments of the transmission back together for you. You can use the Follow TCP Stream feature for this.
July 28, 2009 at 4:31 pm #25907VedderParticipant
Thanks Don and Ketchup
It’s SSL traffic, I’ve decrypted it in Wireshark using the key, and can see them in hex code in the outputted file. Wireshark just shows the encrypted data still.
I’ll carry on with NetWitness, as it does look like a very nice tool.
NetWitness has come up trumps, and given me the files.
Thanks again Don and Ketchup
July 29, 2009 at 5:18 am #25908UNIXParticipant
Thanks for the hint about NetWitness, haven’t heard about it before. Definitely sounds interesting and useful.
July 29, 2009 at 9:47 am #25909dalepearsonParticipant
Late to the party on this one.
As previously said, Netwitness is a cracking product, I used it when they charged for it in the Corporate environment.
Now they have the free one, I have it on my personal machine, and its good stuff.
Deffo worth a download.
August 21, 2009 at 2:53 pm #25910305miaParticipant
So I have an AIM conversation in which a document was exchanged via AIM’s file sharing function.
NetWitness recreated the conversation from my pcap file and shows the document name.
I am having trouble reconstructing the attachment document. I know it is a word doc but how can I actually reconstruct the document?
Thanks in advance
August 25, 2009 at 4:20 pm #25911
August 25, 2009 at 10:19 pm #25912Clay BriggsParticipant
Nice. I’ve not worked with the Netwitness Investigator program before. My first interaction with Netwitness was out at an afterparty with some of the folks in Vegas this year. And watching my girlfriend verbally emasculate one of their VPs as he drunkenly tried to impress/pick her up. It was one of those times where I was reminded on why I want to marry her hehehe.
August 26, 2009 at 5:32 am #25913
August 26, 2009 at 5:29 pm #25914rattisParticipant
I used the site too (about pulling hex from pcap). It allowed me to finish the ISC.SANS.Org puzzle. Which I actually had a lot of fun doing. While TCPXtract was close at pulling the file out, and it worked on my nix box with Open Office, it didnt’ work on my office window’s box with office 2k3 (with 2k7 plugin).
August 26, 2009 at 9:54 pm #25915blackazarroParticipant
Hey chrisj, check this perl script out for extracting Office 2007 Metadata:
The script works, I tried against the docx file from the evidence pcap and it gave me some info such as the name of the file creator, creation and modify timestamp. Thats some cool info that you can include in your network forensic report.
You don’t need the script to get this info but its quicker.
- You must be logged in to reply to this topic.