Lion Cipher Lab
Carve transferred files out of a PCAP with tshark
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
When an investigation hands you a packet capture, the question is rarely "did traffic happen" — it's "what left the building, and can I get it back?" Carving the actual files out of a PCAP turns a wall of packets into evidence you can hash, scan, and submit. tshark does the reassembly for you, so you spend your time on the forensic question, not the protocol. Just as important is knowing when carving quietly fails — encrypted traffic and gappy captures both hand you nothing, or worse, a truncated file that looks real. An analyst who trusts a carved object without checking its hash and its…
What you'll learn
- Network file carving
- tshark CLI (--export-objects)
- tshark display & capture filters
- Hash-verifying recovered evidence (sha256)
- Knowing the limits of object extraction (TLS, truncated captures)
Steps in this lab
- What "carving" means here — and the boundary
- Make a known payload and fingerprint it
- Capture the transfer on loopback
- Carve the file back out and prove it matches
- Read what actually crossed the wire
- Honest limit 1 — TLS defeats carving
- Honest limit 2 — a truncated capture carves a broken file
- What carving proves — and what it doesn't