# Extract All Files from .pcap

**URL:** <https://community.zeek.org/t/extract-all-files-from-pcap/6926>\
**Category:** Zeek\
**Created:** [February 27, 2023, 6:15am UTC](https://community.zeek.org/t/extract-all-files-from-pcap/6926 "2023-02-27T06:15:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [February 27, 2023, 6:15am UTC](https://community.zeek.org/t/extract-all-files-from-pcap/6926/1 "2023-02-27T06:15:45Z")

</div>

Hello all,

When I asked ChatGPT to find out which file types were extracted, I saw that files such as portable \*  
`executable files, office documents, pdf documents, archives, javascript files, html files, images, audio and video files` can be obtained when configured with the appropriate **file extraction policy**.

In directory which is /opt/zeek/share/zeek/policy/frameworks/files, there is a zeek file _extract-all-files.zeek_. Could all content be extracted from the pcap file to be used, or is a config file required for each file type?

How can I find a solution about that?

---

<div class="post-metadata">

**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\
**Post date:** [February 28, 2023, 2:25am UTC](https://community.zeek.org/t/extract-all-files-from-pcap/6926/2 "2023-02-28T02:25:41Z")

</div>

Hi there,

The `extract-all-files.zeek` script is a very basic setup for extracting any file Zeek encounters to disk, with minimal polish. I suggest you try it out to see what it does. For more details, take a look at [our documentation](https://docs.zeek.org/en/master/frameworks/file-analysis.html), and for an off-the-shelf solution for configurable file extraction, take a look at [this Zeek package](https://github.com/hosom/file-extraction).

Best,  
Christian