Extract file by hash
arkime_file_by_hashRead-only
Look up a transferred file by its MD5 or SHA256 hash across Arkime sessions. Returns file magic, size, and optional download URL, never the raw bytes.
Instructions
Extract the transferred file matching a content hash across sessions; returns METADATA ONLY.
Pivots from a file-hash IOC to the actual bytes: Arkime finds the most
recent session carrying a body with this hash, resolves the capture node,
and fetches the file. Checks the file-magic and returns metadata (magic,
size) only — the raw bytes are never put in the MCP response — and
enforces a size cap, refusing oversized files (use url_only then). Get
the hash from arkime_session_detail (http.md5 / http.sha256). For the
whole session's packets rather than one carried file use
arkime_session_pcap. Returns whether a match was found plus its metadata.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url_only | No | If true, return only the download URL and skip the download. | |
| file_hash | Yes | The transferred file's content hash: md5 (32 hex chars) or sha256 (64 hex chars). Taken from a session's http.md5 / http.sha256 field (see arkime_session_detail). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |