# \- extracted filename with md5 **URL:** \ **Category:** Zeek\ **Created:** [April 28, 2019, 7:04am UTC](https://community.zeek.org/t/extracted-filename-with-md5/5680 "2019-04-28T07:04:07Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\ **Post date:** [April 28, 2019, 7:04am UTC](https://community.zeek.org/t/extracted-filename-with-md5/5680/1 "2019-04-28T07:04:07Z")
Hi everyone, I want to extract files and have their names include their md5 hash. The problem is that the md5 hashing happens on file\_hash event while file extraction occurs on former events such as file\_new or file\_over\_new\_connection. Any ideas on how to accomplish this? Thanks B ---
**Author:** ![Liviu\_Valsan](https://avatars.discourse-cdn.com/v4/letter/l/ebca7d/32.png) [@Liviu\_Valsan](https://community.zeek.org/u/Liviu_Valsan)\ **Post date:** [April 29, 2019, 1:41pm UTC](https://community.zeek.org/t/extracted-filename-with-md5/5680/2 "2019-04-29T13:41:22Z")
Hi, Below you can find a script that does file extraction and renames files to include the MD5 hash of the file. I’m using the file\_sniff event to extract files and at this point I save them using the timestamp and the file ID. Extracted files are saved in a top level directory. Later on, in the file\_state\_remove event (at which point the file’s MD5 should be available) I rename the file using the MD5 hash, and retaining the file’s extension. I’m saying that in the file\_state\_remove event the file’s MD5 should be available, but it’s not always the case. One possible situation in which the MD5 is missing is when Zeek is missing some bytes. Renamed files are being moved in a sub-directory using the date when the file was seen. The script below allows you to customise the MIME types of the files that you want to extract and to restrict it to files downloaded by one given IP address. Feel free to customise it to fit your needs. The location where files are extracted can be customised as well. Cheers, Liviu ```auto # MIME-types to be extracted ``` ```auto const extracted_mime_types = set( ``` ```auto # Images: ``` ```auto "image/jpeg", ``` ```auto "image/png" ``` ```auto ); ``` ```auto ``` ```auto # Client for which to extract files ``` ```auto const target_client = 10.0.0.1 &redef; ``` ```auto ``` ```auto redef FileExtract::prefix = "/data/zeek/extracted_files/"; ``` ```auto ``` ```auto export { ``` ```auto ## Path where extracted files are saved ``` ```auto const file_extract_path: string = "/data/zeek/extracted_files/" &redef; ``` ```auto } ``` ```auto ``` ```auto # File extraction ``` ```auto event file_sniff(f: fa_file, meta: fa_metadata) ``` ```auto { ``` ```auto # Check the right mime-type to extract. ``` ```auto if ( ! meta?$mime_type || meta$mime_type !in extracted_mime_types ) ``` ```auto return; ``` ```auto ``` ```auto if ( target_client !in f$info$rx_hosts ) ``` ```auto return; ``` ```auto ``` ```auto for (i in meta$mime_types) ``` ```auto { ``` ```auto if(meta$mime_types[i]$mime in extracted_mime_types) ``` ```auto { ``` ```auto local fext = split_string(meta$mime_types[i]$mime, /\//)[1]; ``` ```auto local ntime = fmt("%D", network_time()); ``` ```auto local fname = fmt("%s_%s.%s", ntime, f$id, fext); ``` ```auto Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]); ``` ```auto break; ``` ```auto } ``` ```auto } ``` ```auto } ``` ```auto ``` ```auto ``` ```auto event file_state_remove(f: fa_file) ``` ```auto { ``` ```auto ``` ```auto if ( !f$info?$extracted || !f$info?$md5 || FileExtract::prefix == "" ) ``` ```auto return; ``` ```auto ``` ```auto local orig = f$info$extracted; ``` ```auto ``` ```auto local split_orig = split_string(f$info$extracted, /\./); ``` ```auto local extension = split_orig[|split_orig|-1]; ``` ```auto ``` ```auto local ntime = fmt("%D", network_time()); ``` ```auto local ndate = sub_bytes(ntime, 1, 10); ``` ```auto local dest_dir = fmt("%s%s", FileExtract::prefix, ndate); ``` ```auto mkdir(dest_dir); ``` ```auto local dest = fmt("%s/%s.%s", dest_dir, f$info$md5, extension); ``` ```auto ``` ```auto local cmd = fmt("mv %s/%s %s", FileExtract::prefix, orig, dest); ``` ```auto when ( local result = Exec::run([$cmd=cmd]) ) ``` ```auto { ``` ```auto } ``` ```auto f$info$extracted = dest; ``` ```auto } ``` ```auto ``` ```auto ``` ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/extracted-filename-with-md5/5680/3 "2022-05-06T15:46:28Z")