Extract file by hash
arkime_file_by_hashRead-only
Check captured sessions for a transferred file matching a provided MD5 or SHA256 content hash; returns metadata (type, size) only and an optional download URL for forensic review.
Instructions
Extract the transferred file matching a content hash across sessions; returns METADATA ONLY.
Pivots from a file-hash IOC to the actual bytes: Arkime finds the most
recent session carrying a body with this hash, resolves the capture node,
and fetches the file. That "most recent" is the catch — when the same
file moved several times, this answers about the last transfer, which is
usually not the one under investigation. Use this to find out whether a
known-bad hash appeared at all, and arkime_session_file_by_hash to pin
the answer to a session you already hold — a "no match" here is not
proof the file is absent, since measured on Malcolm v26.07.1 that route served
a body this one declined. Checks the file-magic and returns metadata
(magic, size) only — the raw bytes are never put in the MCP response —
and refuses a file over 100 MB before reading it (use url_only then).
The hash comes from a session's http.md5 / http.sha256, which
malcolm_search returns. For the whole session's packets rather than one
carried file use arkime_session_pcap. Returns whether a match was found
plus its metadata.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url_only | No | If true, return only the download URL and skip the download. | |
| file_hash | Yes | The transferred file's content hash: md5 (32 hex chars) or sha256 (64 hex chars). Taken from a session's http.md5 / http.sha256 field, which malcolm_search returns and arkime_session_detail does not (measured on Malcolm v26.07.1). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |