# Extract Files from Network Capture
> Carve downloaded payloads and exfiltrated data from PCAP

**Tools:** [[tools/tcpxtract|tcpxtract]], [[tools/tcpflow|tcpflow]], [[tools/networkminer|networkminer]]

## Commands
```bash
# Carve files using signatures
tcpxtract -f <capture.pcap> -o carved/
# Extract individual TCP streams
tcpflow -r <capture.pcap> -o streams/
# Or use NetworkMiner for automated extraction
NetworkMiner --pcap <capture.pcap>
```

#recipe #tcpxtract #tcpflow #networkminer