Session reconstruction

Session reconstruction is the process of rebuilding complete user sessions from captured network traffic by recovering the application-layer content (files, email, web pages, instant messages) that was exchanged. It works on full packet capture data, where every byte of the transmission is available for inspection.

See also

• Network Forensics

Tools

• Chaosreader is a session reconstruction tool (supports both live or captured network traffic)
• Xplico