Fetch a file carried by ONE session
arkime_session_file_by_hashRead-only
Fetch metadata for the file a specific session carried, matched by content hash. Session-scoped to give the correct transfer even if the same file exists elsewhere.
Instructions
Fetch the file one NAMED session carried, by content hash; returns METADATA ONLY.
Session-scoped, which is the whole difference from arkime_file_by_hash:
that one serves the most recent body carrying the hash across all
sessions, so once a file has moved twice it answers about the wrong
transfer. Prefer this whenever you hold a session id — measured on
Malcolm v26.07.1, for the window's most-carried md5 this route served
the body from each of the three sessions that carried it while the
sibling answered found:false, "No match found." for the same hash. Use
malcolm_extract_file instead when Zeek carved the file to disk — that
needs no session, but only works where file extraction is enabled.
The bytes never enter the response and nothing is written to disk: a
carved file may be live malware. The md5 and sha256 returned are
computed over the bytes Arkime actually served, so comparing them with
the hash you asked for shows whether the reconstructed body is complete.
A hash this session did not carry is a successful answer with
found:false, not an error — Arkime's own 400 "No match" — while a body
over 100 MB is refused, url_only being the way through.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| node | No | Capture node that recorded the session (the `node` field of the arkime_sessions row). Empty resolves it from the session document, one extra request, and is also done for url_only. | |
| url_only | No | If true, return only the download URL and skip the download. | |
| file_hash | Yes | Content hash of the carried body: md5 (32 hex chars) or sha256 (64). It lives in this session's own http.md5 / http.sha256, which malcolm_search returns and arkime_session_detail does not (measured on Malcolm v26.07.1: that row carries http.uri but no hash). A hash from a different session is answered "no match" even though the file exists elsewhere. | |
| session_id | Yes | The session that carried the file, from an arkime_sessions row. This is what makes the answer specific: the same file moving five times has five sessions, and this asks about one of them. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |