Ethereal-users: Re: [Ethereal-users] fix cap file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 11 Aug 2005 09:45:56 -0700
Jordi Casas wrote:
Hi, I have a file "CAP" which is damaged, I would like to know if some
tool exists to recover it.
The mistake consists of the fact that a package occupies more of the allowed.

You might try a hex editor. (They exist, but I don't know the names of ones available for various platforms.)

Unfortunately, that means repairing them manually, which means you have to know how the damage occurred, and how to fix the file - which, if the damage occurred by removing bytes of the file, or replacing bytes with bytes with different values, you'd need to know which bytes were removed or replaced and what their original values were, and if it occurred by inserting bytes into the file, you'd have to know which bytes were inserted.

How did the file get damaged? (If it was, for example, transferred between a Windows machine and a UN*X machine - "UN*X machine" here includes Macs running OS X, as well as machines running other BSDs, machines running Linux distributions, Solaris machines, AIX machines, HP-UX machines, etc. - by FTPing it in ASCII mode, that transfer would damage the file by inserting or removing bytes.)