Artefact Carving
Definition
Extracting embedded content from raw data by locating known file signatures (magic bytes) at byte boundaries. In PCAP analysis, this means reassembling the application payload of a session and extracting any complete files whose headers and trailers appear in the stream.
- Also called
- File carving
- Basis
- File signatures (magic bytes)
- Common domain
- PCAP and network traffic analysis
- Requires
- Header and trailer both present in stream
Common questions
Why can carving fail on network traffic even when a file was clearly transferred?+
If the capture missed packets, the session was fragmented across multiple TCP streams, or the connection used compression or encryption, the byte stream reassembled from the PCAP may lack an intact header-to-trailer sequence for the carver to extract.
How does carving from a PCAP differ from carving unallocated disk space?+
Disk carving searches static, already-written sectors for signatures, while PCAP carving first reassembles a live application-layer payload from out-of-order or retransmitted packets before signature matching can even begin.
Related terms
- Beaconing
- Periodic outbound connections from a compromised host to a command-and-control server, typically at regular intervals. The regularity of the interval, measured in...
- Display Filter
- A Wireshark filter expression applied to an already-captured PCAP file to show only packets matching specified criteria. Display filters do not delete...
- PCAP
- Packet capture file. The standard format for storing captured network frames, originally defined by the libpcap library. Each record contains the raw...
- Protocol Dissector
- A software component in a packet analyser that recognises a specific protocol and parses its header fields into named, readable values. Wireshark...
- Stream Reassembly
- The process of collecting all the TCP segments belonging to a single connection and reordering them by sequence number to reconstruct the...