Cool! I'll give it a try and post my results
thanks,
mack
On 4 Sep 2003 at 20:11, Darren Forster wrote:
>
> Mack,
>
> Yes you can do it, you have to go to tools and select follow tcp
> stream.
>
> This will extract the data sent within a specific TCP session.
> Save the file to another file.
> Then open file in wordpad or similar and remove the header fields so
> that the first characters in the file are : GIF......
>
> Save this file and then open it up in any image viewer.
> Do the same for jpeg files... I can't remember what jpeg files start
> with but it should be obvious when you view the TCP stream.
>
> Let me know how you get on!
>
> Darren
> -----Original Message-----
> From: ethereal-users-bounces@xxxxxxxxxxxx
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx]On Behalf Of Mack
> Sent: Wednesday, September 03, 2003 5:30 PM
> To: ethereal-users@xxxxxxxxxxxx
> Subject: [Ethereal-users] reconstruct captured data?
>
>
> Question...
>
> Legal issues aside --
> Is it possible to reconstruct data that's been captured? For
> instance, if someone is suspected of trafficing child pornography,
> would it be possible to take captured data from that machine and
> reconstruct an image?
>
> thanks!
>
> --
> This message has been scanned for viruses and
> dangerous content by the CSU Email Gateway, and is
> believed to be clean.
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
> --
> This message has been scanned for viruses and
> dangerous content by the CSU Email Gateway, and is
> believed to be clean.
>
--
This message has been scanned for viruses and
dangerous content by the CSU Email Gateway, and is
believed to be clean.