# Extract complete files
**URL:** https://community.zeek.org/t/extract-complete-files/3594
**Category:** Zeek
**Created:** [May 12, 2015, 5:12pm UTC](https://community.zeek.org/t/extract-complete-files/3594 "2015-05-12T17:12:58Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)
#### Post date: [May 12, 2015, 5:12pm UTC](https://community.zeek.org/t/extract-complete-files/3594/1 "2015-05-12T17:12:58Z")
Hello,
I am experimenting with the Files framework in bro 2.4 beta. I would like to extract HTTP files, \*without\* missing\_bytes.
Can anyone please help me on this?
Thanks,
Albert
---
### Author:  [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)
#### Post date: [May 13, 2015, 11:30am UTC](https://community.zeek.org/t/extract-complete-files/3594/2 "2015-05-13T11:30:51Z")
Hello,
I am experimenting with the Files framework in bro 2.4 beta. I would like to extract HTTP files, \*without\* missing\_bytes.
Can anyone please help me on this?
Thanks,
Albert
---
### Author:  [@Franky](https://community.zeek.org/u/Franky)
#### Post date: [May 13, 2015, 2:46pm UTC](https://community.zeek.org/t/extract-complete-files/3594/3 "2015-05-13T14:46:00Z")
Hi Albert,
it’s hard to help without any context, so just some hints: It took me some time to find the -C switch to ignore wrong checksums in bro. Without it the traffic did not reach the extraction layer. Also it’s always a good idea to compare bro with other tools. Make sure wireshark does show the complete http session.
Franky
---
### Author:  [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)
#### Post date: [May 13, 2015, 3:12pm UTC](https://community.zeek.org/t/extract-complete-files/3594/4 "2015-05-13T15:12:24Z")
Hi Frank,
Perhaps I didn’t explain myself properly. I meant extracting only complete files (or removing incomplete ones). There might be file gaps because of improper taping…
I attached the Files::ANALYZER\_EXTRACT and Files::ANALYZER\_SHA256 in the file\_sniff event. The event\_hash triggers only for complete files, but the file gets extracted anyway.
Albert
---
### Author:  [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)
#### Post date: [May 13, 2015, 3:17pm UTC](https://community.zeek.org/t/extract-complete-files/3594/5 "2015-05-13T15:17:06Z")
Albert,
You have a chicken and egg problem. Specifically, you're not going to be certain of how many bytes are missing at the time you have to determine whether or not you'll be extracting the file. Instead, you'll have to extract all files and then later remove the files that aren't the ones that you want. This is similar to how the issue of 'how do I name the file after the hash' is solved.
I have some examples of that here in the plugins directory: [https://github.com/hosom/bro-file-extraction/](https://github.com/hosom/bro-file-extraction/)
While it isn't precisely what you want... you'll be able to piece together the hashing examples into removing files from the filesystem that show as having missing bytes.
If you're seeing a large number of missing bytes in files consistently, there are likely other problems occurring.
Thanks,
Stephen
---
### Author:  [@Albert\_Zaharovits](https://community.zeek.org/u/Albert_Zaharovits)
#### Post date: [May 13, 2015, 3:24pm UTC](https://community.zeek.org/t/extract-complete-files/3594/6 "2015-05-13T15:24:27Z")
Hi Stephen,
Your rename-after-hash example is a life saviour!
Thanks a bunch,
Albert
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/extract-complete-files/3594/7 "2022-05-06T15:42:39Z")