Exporting objects

The carve follows the decode

File, then Export Objects, then HTTP, lists objects the HTTP dissector reassembled: the host, the path, the content type, and a size. Save the ones that answer the question into the case folder. The list is only as good as the decode. TCP reassembly has to be on, the snap length has to include the body, and the protocol has to be cleartext HTTP or TLS you have already decrypted with a key you were given.

SMB and a few other protocols have their own export lists. If the menu for HTTP is empty, do not keep clicking it. Check whether the file actually contains HTTP. A TLS capture without keys produces an empty HTTP list, which is the correct result.

Treat the bytes as evidence, then as a file

An exported object is a new file with its own hash. Record the hash next to the stream index and the URI it came from, so you can show the bytes did not change after export. The hash is an integrity check on your evidence handling. It is not a verdict about what the file is.

A lab capture of a file transfer is still a file. If you do not know whether it is safe to open, do not open it on the machine you use for mail and accounts. Keep it in the lab, on a guest that can be reverted. The point of the export, for this curriculum, is to see that the bytes were in the capture and to store them deliberately.

Worked case: the status page and a missing download

The cleartext lab server 10.8.0.20 served GET /status and GET /manual.pdf in the same file. Export Objects, HTTP, shows /status as text/plain and /manual.pdf as a larger object. You save the PDF into the case folder and hash it. The stream index from the conversation list goes in the note, so a reviewer can find the source frames without trusting the extracted file alone.

A third row you expected, a download from a TLS site, is absent. That session has no key log. The object was never reassembled as HTTP, because Wireshark never saw HTTP. You write “not exported, session remained encrypted” instead of “the file was not transferred.” The endpoints may have moved the bytes. This capture could not carve them.

Snippet

http.request.uri == "/manual.pdf"

Export the packets too

The carved object and the packets are a pair. Export Specified Packets for that tcp.stream next to the object. A reviewer can rebuild the story: request, response, object, hash. One of those without the others is a loose file of unclear origin.

Do not post the object, or the pcapng, to a shared chat because the export was exciting. The agreement that allowed the capture still covers the copy.

Diagram

From a reassembled HTTP body to a file with a hash

Decode
Confirm cleartext HTTP, or TLS you have already opened with a lab key log.
List
Export Objects, HTTP. An empty list means the dissector had nothing to carve.
Find the request first
```
http.request.uri == "/manual.pdf"
```
Save
Write the object into the case folder. Record the stream index and a hash.
Pair
Export the packets of that stream beside the object.

Check yourself

1. Export Objects, HTTP, is empty on a file that is entirely TLS and has no key log. What does that mean?

2. A cleartext download is in the packet list, and Export Objects does not list it. What do you check first?

3. What should you store next to the extracted file?