At a manufacturer, a packet capture contains one unencrypted file download carried on a single TCP session. How should the analyst recover that file from the capture?
Select an answer to reveal the explanation.
Short Explanation
Pages of a torn letter have to be put back in order before you can read it. You recover this unencrypted download by reassembling the one TCP session and saving the object. The trap is treating a checksum, a set of timestamps, or a trailer hash as the file.
Full Explanation
An unencrypted file download on one TCP session is split across segments. Putting those segments back in order reconstructs the byte stream, and the file can be saved from that stream. The recovery step is Reassemble that TCP stream, follow the stream, and save the transferred object from it. Following the stream is the view that presents the reassembled payload so the object can be taken out of it. Read the IP header checksum and treat that value as the recovered download looks at an integrity field for the IP header, not at the file the application transferred. Export NetFlow from the capture timestamps only and treat those times as the file keeps timing metadata and discards the content. Hash the Ethernet trailer and treat that digest as the downloaded object fingerprints a link-layer field and is not the transferred file. Exam caveat: reassembly puts the captured TCP payload back in order, and a header checksum or a timestamp export is not that payload. Operational check: follow the TCP stream for that single session, confirm the bytes are the readable transfer, and save the object.