Extract file by hash
arkime_file_by_hashRead-only
Find whether a known-bad MD5/SHA256 appeared in captured traffic and return the matching transferred file's metadata only (magic, size), not bytes.
Instructions
Extract the transferred file matching a content hash across sessions; returns METADATA ONLY.
Pivots from a file-hash IOC to the actual bytes: Arkime finds the most
recent session carrying a body with this hash, resolves the capture node,
and fetches the file. That "most recent" is the catch — when the same
file moved several times, this answers about the last transfer, which is
usually not the one under investigation. Use this to find out whether a
known-bad hash appeared at all, and arkime_session_file_by_hash to pin
the answer to a session you already hold — a "no match" here is not
proof the file is absent, since that route can serve a body this one
declines. Checks the file-magic and returns metadata
(magic, size) only — the raw bytes are never put in the MCP response —
and refuses a file over 100 MB before reading it (use url_only then).
The hash comes from a session's http.md5 / http.sha256, which
malcolm_search returns. For the whole session's packets rather than one
carried file use arkime_session_pcap. Returns whether a match was found
plus its metadata.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url_only | No | If true, return only the download URL and skip the download. | |
| file_hash | Yes | The transferred file's content hash: md5 (32 hex chars) or sha256 (64 hex chars). Taken from a session's http.md5 / http.sha256 field, which malcolm_search returns and arkime_session_detail does not. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |