Method and apparatus for implementing FTP file restoration

Abstract

The application discloses a method and device for realizing FTP file restoration. On one hand, continuous data flow is recovered under the conditions of disorder, retransmission, short-time packet loss and the like by analyzing an FTP control channel and combining index backtracking and TCP flow recombination, so that the restoration gap is minimized, and the completeness and success rate of FTP file restoration are improved. On the other hand, by pre-filtering a non-pre-set protocol, cooperating with the establishment of file index information relationship of the original message corresponding to the five-tuple information, the original message saving amount and disk write amplification are significantly reduced, so that the storage and I / O overhead are reduced, the system throughput is improved, and the historical retention window is prolonged.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of computer technology, and in particular to a method and apparatus for restoring FTP files. Background Technology

[0002] File Transfer Protocol (FTP) is an application-layer protocol used for exchanging files between two computers in a Transmission Control Protocol / Internet Protocol (TCP / IP) network. It was one of the earliest and most widely used file transfer methods on the Internet. Through an FTP client, users can send requests to an FTP server to download files, upload files, and create or modify directories on the server.

[0003] With the rapid development of information technology, the application of networks in various industries is becoming increasingly widespread, and network security issues are becoming increasingly prominent. Especially in the field of network traffic analysis and security monitoring, the security of FTP file transfers has become a major concern. Because the FTP protocol often uses plaintext during transmission, it is extremely vulnerable to interception, tampering, or the inclusion of malicious files. Therefore, accurately identifying and restoring FTP-transmitted files is of great importance in network security protection. Summary of the Invention

[0004] This application provides a method and apparatus for restoring FTP files, which can improve the integrity and success rate of FTP file restoration, while reducing storage and I / O overhead.

[0005] This invention provides a method for restoring FTP files, comprising:

[0006] The command parses the FTP control channel of the File Transfer Protocol (FTP) to obtain the 5-tuple information of the FTP data channel used for file transfer.

[0007] Save the original message of the non-preset protocol, and save the file index information of the original message corresponding to the five-tuple information;

[0008] When a file needs to be restored, the file index information of the original message is queried based on the 5-tuple information, and the original message of the FTP data channel is obtained based on the queried file index information;

[0009] The target file is generated based on the data obtained after stream reassembly of the original messages.

[0010] In one exemplary instance, obtaining the 5-tuple information of the FTP data channel used for file transfer includes:

[0011] Obtain mirror traffic;

[0012] If the obtained mirrored traffic is Transmission Control Protocol (TCP) traffic, for the FTP control channel, parse the commands of the FTP control channel to extract the corresponding 5-tuple information of the FTP data channel;

[0013] Add the obtained 5-tuple information of the FTP data channel to the FTP file transfer list.

[0014] In one exemplary instance, the step of saving the original message of a non-preset protocol and saving the file index information of the original message corresponding to the five-tuple information includes:

[0015] The mirrored traffic is read packet by packet to form an original message stream, and the mirrored traffic is filtered according to the preset protocol. If the current original message does not belong to the preset protocol, the current original message is saved to the message file, and the index information of the original message file corresponding to the five-tuple is written to the database.

[0016] In one exemplary instance, the method further includes: discarding the current original message if the current original message belongs to the preset protocol.

[0017] In one exemplary instance, when a file needs to be restored, the process involves querying the file index information of the original message based on the 5-tuple information, and generating a target file from the data obtained after stream reassembly of the original message, including:

[0018] A scheduled task is triggered to iterate through the FTP file transfer list;

[0019] The message index information of the original message is retrieved based on the five-tuple in the FTP file transfer list;

[0020] After locating and reading all the original packets according to the queried packet index, TCP stream reassembly is performed to extract the payload of the FTP data channel, and the reassembled data is written to the target file to restore the TPF file.

[0021] In one exemplary instance, the method further includes: if no message index information for the original message is found, returning to the step of traversing the FTP file transfer list.

[0022] This application also provides a computer-readable storage medium storing computer-executable instructions, which are used to execute the method for restoring FTP files as described above.

[0023] This application embodiment further provides a computer device, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for performing the steps of the method for restoring FTP files as described in any of the above claims.

[0024] This application embodiment further provides an apparatus for restoring FTP files, including: an acquisition module, a saving module, and a processing module; wherein,

[0025] The acquisition module is used to parse commands from the FTP control channel and obtain the 5-tuple information of the FTP data channel used for file transfer.

[0026] The storage module is used to store the original messages that are not based on the preset protocol, and to store the file index information of the original message corresponding to the five-tuple information.

[0027] The processing module is used to query the file index information of the original message based on the five-tuple information when a file needs to be restored, obtain the original message of the FTP data channel based on the queried file index information, and generate the target file from the data obtained by stream reconstruction of the obtained original message.

[0028] In one exemplary instance, the storage module is used to:

[0029] The mirrored traffic is read packet by packet to form an original message stream, and the mirrored traffic is filtered according to the preset protocol. If the current original message does not belong to the preset protocol, the current original message is saved to the message file, and the index information of the original message file corresponding to the five-tuple is written to the database.

[0030] The method for restoring FTP files provided in this application embodiment, on the one hand, by parsing the FTP control channel and combining indexed backtracking and TCP stream reassembly, restores continuous data streams under conditions such as out-of-order delivery, retransmission, and short-term packet loss, minimizing restoration gaps and improving the integrity and success rate of FTP file restoration; on the other hand, by pre-filtering non-preset protocols and establishing the file index information relationship corresponding to the original message of the five-tuple information, the amount of original message storage and disk write amplification are significantly reduced, thereby reducing storage and I / O overhead, improving system throughput, and extending the historical retention window.

[0031] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0032] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0033] Figure 1 This is a flowchart illustrating the method for restoring FTP files in an embodiment of this application;

[0034] Figure 2 This is a schematic diagram of the process of saving the original message in the FTP file restoration embodiment of this application;

[0035] Figure 3 This is a schematic diagram of the process of restoring FTP files in the embodiments of this application;

[0036] Figure 4 This is a flowchart illustrating the apparatus for restoring FTP files in an embodiment of this application. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be arbitrarily combined with each other.

[0038] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein in the specification of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application.

[0040] It is understood that the terms "first" and "second" used in this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0041] It is understood that the term "connection" in the following embodiments should be understood as "electrical connection," "communication connection," etc., if the connected circuits, modules, units, etc., have electrical signal or data transmission with each other.

[0042] When used herein, the singular forms of “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising / including” or “having,” etc., specify the presence of the stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. Meanwhile, the term “and / or” as used in this specification includes any and all combinations of the associated listed items.

[0043] The steps illustrated in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases the steps shown or described may be performed in a different order than that presented here.

[0044] In practical applications, network administrators often collect network traffic data through mirrored ports of core switches and analyze the traffic using protocol parsing techniques. For FTP traffic, it is necessary to completely restore the transmitted content to the original files for further malicious code detection, content review, or forensic analysis. However, due to limitations such as network environment complexity, data fragmentation, and packet loss, existing technologies still fall short in terms of FTP file restoration rate and integrity. Therefore, a technical solution to improve FTP file restoration performance is urgently needed.

[0045] Figure 1 This is a flowchart illustrating the method for restoring FTP files in an embodiment of this application, as shown below. Figure 1 As shown, it may include:

[0046] Step 100: Parse the commands of the FTP control channel to obtain the 5-tuple information of the FTP data channel used for file transfer.

[0047] In one exemplary instance, step 100 may include:

[0048] Obtain mirror traffic;

[0049] If the obtained mirrored traffic is TCP traffic, for the FTP control channel, the command to parse the FTP control channel is used to extract the corresponding 5-tuple information of the FTP data channel;

[0050] Add the 5-tuple information of the obtained FTP data channel to the FTP file transfer list.

[0051] Step 100 parses the commands on the FTP control connection (TCP / 2 or a custom port), identifies the 5-tuple of the FTP data channel corresponding to each file transfer, and writes it into the FTP file transfer list.

[0052] The FTP control channel is used to transmit commands and responses between the client and server. The client sends login, download, and upload commands to the server via the FTP control channel, and the server returns operation results via the FTP control channel. The FTP control channel remains connected throughout the entire FTP session, using the TCP protocol, and the default port number is 21.

[0053] An FTP data channel is used to transfer actual data. For example, data involved in operations such as uploading files, downloading files, and listing directory contents is transferred through an FTP data channel. Unlike the FTP control channel, an FTP data channel is established on demand; it is only established when data needs to be transferred and closed after the transfer is complete. FTP data channels are also based on the TCP protocol, and their port numbers are negotiated through commands used in the FTP control channel.

[0054] A 5-tuple is used to identify a network session and includes: source IP, source port, destination IP, destination port, and transport layer protocol.

[0055] Step 101: Save the original message of the non-preset protocol and save the file index information of the original message corresponding to the five-tuple information.

[0056] In one exemplary instance, step 101 may include: reading the mirrored traffic packet by packet to form an original message stream, filtering it according to a preset protocol (such as filtering common protocol messages unrelated to FTP), and for messages that do not belong to the preset protocol, saving the current original message to a message file, and writing the index information of the file containing the original message corresponding to the five-tuple to a database. Specifically, it may include: filtering messages of the preset protocol; saving the original messages of unfiltered protocols to a file, and saving the index information of the file containing the original message corresponding to the five-tuple to a database. In this embodiment, the original message refers to a single data packet record obtained one by one from the mirrored traffic without parsing or rewriting.

[0057] Step 101 may also include: if the current original message belongs to a message of a preset protocol, discard the current original message.

[0058] In step 101, based on the mirrored traffic from the core switch, raw packets of non-preset protocols (i.e., protocols that have not been filtered out, including the target FTP data channel) are sequentially written to a file, and the correspondence between the five-tuple and the index of the file containing the packet is written to the database. In this step, filtering refers to discarding non-FTP packets of preset protocols, while retaining FTP control / data channel related packets and other protocol packets not listed in the preset protocols.

[0059] In one embodiment, the preset protocol may include, but is not limited to, non-FTP protocols such as encrypted transport protocols based on User Datagram Protocol (UDP) (e.g., Hypertext Transfer Security Protocol (HTTPS), Secure Shell Protocol (SSH), etc.), Hypertext Transfer Protocol (HTTP), Simple Mail Transfer Protocol (SMTP), Server Message Block Protocol (SMB), etc.

[0060] Step 102: When a file needs to be restored, query the file index information of the original message based on the 5-tuple information, and obtain the original message of the FTP data channel based on the queried file index information.

[0061] In one exemplary instance, step 102 may include: when it is necessary to restore a file transferred via FTP, using the 5-tuple recorded in step 100 as the key, finding the location of the corresponding original message in the database (i.e., the index library) where the original message corresponding to the 5-tuple is stored in step 101, and retrieving the original message.

[0062] Step 103: Generate the target file based on the data obtained after stream reassembly of the original message.

[0063] In one exemplary instance, step 103 may include: performing TCP stream reassembly on the retrieved original packets and writing the reassembled payload to the target file, thereby restoring the FTP file.

[0064] In one embodiment, steps 102-103 may include:

[0065] A scheduled task is triggered to iterate through the FTP file transfer list;

[0066] The message index information of the original message can be retrieved based on the five-tuple in the FTP file transfer list;

[0067] After locating and reading all the original packets according to the queried packet index, TCP stream reassembly is performed to extract the payload of the FTP data channel, and the reassembled data is written to the target file to restore the TPF file.

[0068] In one embodiment, if the message index information of the original message is not found, the step of traversing the FTP file transfer list is returned.

[0069] The method for restoring FTP files provided in this application embodiment, on the one hand, by parsing the FTP control channel and combining indexed backtracking and TCP stream reassembly, restores continuous data streams under conditions such as out-of-order delivery, retransmission, and short-term packet loss, minimizing restoration gaps and improving the integrity and success rate of FTP file restoration; on the other hand, by pre-filtering non-preset protocols and establishing the file index information relationship corresponding to the original message of the five-tuple information, the amount of original message storage and disk write amplification are significantly reduced, thereby reducing storage and I / O overhead, improving system throughput, and extending the historical retention window.

[0070] This application also provides a computer-readable storage medium storing computer-executable instructions for performing the FTP file restoration method described in any of the above claims.

[0071] This application further provides a computer device, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: steps for performing the method for restoring FTP files as described in any of the preceding claims.

[0072] Figure 2 This is a flowchart illustrating an embodiment of saving the original message during FTP file restoration in this application, showing specific implementation examples of steps 100-101, such as... Figure 2 As shown, it includes:

[0073] Step 200: Obtain mirrored traffic. This step involves continuously collecting network packets from the mirror port of the core switch for packet-by-packet / flow-by-flow processing.

[0074] Step 201: Determine if the obtained mirrored traffic is TCP traffic. If yes, proceed to step 202; otherwise, end this process. This step achieves early filtering of non-TCP packets unrelated to FTP, reducing irrelevant parsing and storage overhead, and improving overall processing throughput.

[0075] Step 202: Determine if it is an FTP control channel. If yes, proceed to step 203; otherwise, proceed to step 205.

[0076] Step 203: Obtain the FTP data channel 5-tuple. In this step, you can extract the data channel 5-tuple (including source IP, source port, destination IP, destination port, and protocol) and related metadata by parsing FTP control commands (such as PASV / EPSV, PORT / EPRT, RETR / STOR, etc.).

[0077] Step 204: Add to FTP file transfer list, that is, write the 5-tuple information obtained in step 203 into the FTP file transfer list, and end this process.

[0078] In this embodiment, steps 203 and 204 precisely bind the file transfer command to the actual data channel, reducing mismatches and stream errors in complex scenarios such as concurrency, NAT, and port reuse. This lays an accurate input foundation for subsequent backtracking and reassembly by 5-tuple, improving the success rate and integrity of FTP file restoration.

[0079] Step 205: Determine whether the current message belongs to the preset protocol. If it does, discard the message of the preset protocol and end this process; otherwise, proceed to step 206.

[0080] The default protocols may include, but are not limited to, encrypted transmission protocols such as UDP (e.g., HTTPS, SSH), HTTP, SMTP, SMB, and other non-FTP protocols.

[0081] In this embodiment, messages determined to be based on a preset protocol are not saved or indexed, which significantly reduces the amount of original messages saved and disk write amplification, reduces storage and I / O / CPU consumption, improves system throughput and extends the historical retention window, without affecting the effectiveness of the FTP recovery link.

[0082] Step 206: Save the current original message to a message file, and write the index information of the file containing the original message corresponding to the 5-tuple into the database for subsequent fast backtracking and restoration by 5-tuple. At this point, the message processing for this round is complete, and the next round of processing can begin.

[0083] The processing in step 206 forms a traceable link from the original message to the index to on-demand backtracking, which supports rapid location and extraction of the target data channel message and shortens the restoration latency. At the same time, it preserves the evidence chain (filename, timestamp, offset, etc.), which improves the verifiability and auditability of the results and is conducive to scalability and stable throughput in high-traffic environments.

[0084] Figure 3 This is a flowchart illustrating an embodiment of restoring FTP files in this application, showing specific implementation examples of steps 102-103, such as... Figure 3 As shown, it includes:

[0085] Step 300: The scheduled task is triggered to iterate through the FTP file transfer list.

[0086] In one embodiment, the file restoration process can be initiated at a preset cycle (e.g., every 5 minutes / as a scheduled task).

[0087] In one embodiment, the records to be processed (including metadata such as 5-tuple, time window, direction, TYPE / REST, etc.) can be retrieved one by one.

[0088] Step 301: Query the message index information of the original message based on the 5-tuple in the FTP file transfer list. If found, proceed to step 302; if not found, return to step 300 to continue traversing the FTP file transfer list.

[0089] In this step, the corresponding original message location is retrieved from the index database based on the five-tuple (including the time range if necessary) recorded in step 300. If no original message index information is found, the process returns to step 300 to continue traversing the next record (or waits for the next scheduled task); if the original message index is found, the process proceeds to step 302.

[0090] In this embodiment, the index-based key-based retrieval enables rapid location of the target data channel, significantly reducing retrieval latency and read amplification; the rollback record when a match is missed also avoids misprocessing, enhancing process robustness and recoverability.

[0091] Step 302: Obtain the original packets and complete the restoration. In this step, after locating and reading all the original packets according to the index, TCP stream reassembly is performed to extract the payload of the FTP data channel, and the reassembled data is written to the target file, i.e., the TPF file is restored. At this point, this round of scheduled task processing is complete, and we can wait for the next cycle or external trigger.

[0092] Figure 4 This is a flowchart illustrating the apparatus for restoring FTP files in an embodiment of this application. Figure 4 As shown, it may include: an acquisition module, a storage module, and a processing module; wherein,

[0093] The acquisition module is used to parse commands from the FTP control channel and obtain the 5-tuple information of the FTP data channel used for file transfer.

[0094] The storage module is used to store the original messages that are not based on the preset protocol, and to store the file index information of the original message corresponding to the five-tuple information.

[0095] The processing module is used to query the file index information of the original message based on the five-tuple information when a file needs to be restored, obtain the original message of the FTP data channel based on the queried file index information, and generate the target file by reassembling the stream from the obtained original message.

[0096] In one exemplary instance, the acquisition module can be used to:

[0097] Obtain the mirrored traffic; if the obtained mirrored traffic is TCP traffic, for FTP control channels, parse the commands of the FTP control channel to extract the corresponding 5-tuple information of the FTP data channel; add the obtained 5-tuple information of the FTP data channel to the FTP file transfer list.

[0098] In one exemplary instance, the save module can be used to:

[0099] The mirrored traffic is read packet by packet to form the original message stream, and the mirrored traffic is filtered according to a preset protocol. If the current original message does not belong to the preset protocol, the current original message is saved to the message file, and the index information of the original message file corresponding to the five-tuple is written to the database.

[0100] Furthermore, the saving module can also be used to discard the current original message if the current original message belongs to a preset protocol.

[0101] In one exemplary instance, the processing module can be used to:

[0102] When a scheduled task is triggered, the FTP file transfer list is traversed; the packet index information of the original packets is retrieved based on the five-tuple in the FTP file transfer list; after locating and reading all the original packets according to the retrieved packet index, TCP stream reassembly is performed to extract the payload of the FTP data channel, and the reassembled data is written to the target file to restore the TPF file.

[0103] Furthermore, the processing module can also be used to: if the message index information of the original message is not found, return to the step of traversing the FTP file transfer list.

[0104] The apparatus for restoring FTP files provided in this application embodiment, on the one hand, by parsing the FTP control channel and combining indexed backtracking and TCP stream reassembly, restores continuous data streams under conditions such as out-of-order delivery, retransmission, and short-term packet loss, minimizing restoration gaps and improving the integrity and success rate of FTP file restoration; on the other hand, by pre-filtering non-preset protocols and establishing the file index information relationship corresponding to the original message of the five-tuple information, it significantly reduces the amount of original message storage and disk write amplification, thereby reducing storage and I / O overhead, improving system throughput, and extending the historical retention window.

[0105] Although the embodiments disclosed in this application are as described above, the content described is merely for the purpose of understanding this application and is not intended to limit this application. Any person skilled in the art to which this application pertains may make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in this application; however, the scope of patent protection of this application shall still be determined by the scope defined in the appended claims.

Claims

1. A method for implementing FTP file restore, the method comprising: The method comprises the following steps: resolving commands of a file transfer protocol (FTP) control channel to obtain quintuple information of an FTP data channel used for transmitting files; saving original messages of non-pre-set protocols and file index information of the original messages corresponding to the quintuple information; when it is necessary to restore files, querying file index information of the original messages according to the quintuple information, and obtaining the original messages of the FTP data channel according to the queried file index information; generating target files from data obtained after stream recombination of the obtained original messages; wherein the step of obtaining quintuple information of the FTP data channel used for transmitting files comprises the following steps: obtaining mirror traffic; for a case where the obtained mirror traffic is transmission control protocol (TCP) traffic, resolving commands of the FTP control channel to extract quintuple information of the FTP data channel corresponding to the commands; adding the obtained quintuple information of the FTP data channel to an FTP file transmission list; wherein the step of saving original messages of non-pre-set protocols and file index information of the original messages corresponding to the quintuple information comprises the following steps: reading original message streams packet by packet from the mirror traffic, and filtering according to pre-set protocols; for a case where a current original message does not belong to messages of the pre-set protocols, saving the current original message to a message file, and writing index information of a file where the original message corresponding to the quintuple is located into a database; wherein the step of, when it is necessary to restore files, querying file index information of the original messages according to the quintuple information, and generating target files from data obtained after stream recombination of the obtained original messages comprises the following steps: triggering a timing task to traverse the FTP file transmission list; querying message index information of the original messages according to the quintuple in the FTP file transmission list; locating and reading all original messages according to the queried message index, performing TCP stream recombination, extracting payloads of the FTP data channel, and writing the recombined data into the target files to restore TPF files.

2. The method of claim 1, further comprising: for a case where the current original message belongs to messages of the pre-set protocols, discarding the current original message.

3. The method of claim 1, further comprising: for a case where no message index information of the original messages is queried, returning to the step of traversing the FTP file transmission list.

4. A computer readable storage medium storing computer executable instructions for implementing the method for restoring FTP files according to any one of claims 1-3.

5. A computer device comprising a memory and a processor, wherein, The memory stores instructions executable by the processor for implementing the method for restoring FTP files according to any one of claims 1-3.

6. An apparatus for implementing FTP file restore, the apparatus comprising: The method comprises the following steps: an obtaining module, a saving module, and a processing module; wherein The acquisition module is configured to parse a command of an FTP control channel and acquire quintuple information of an FTP data channel used for file transmission; wherein the acquisition of the quintuple information of the FTP data channel used for file transmission comprises: acquiring mirror traffic; for a case where the obtained mirror traffic is transmission control protocol (TCP) traffic, parsing the command of the FTP control channel to extract quintuple information of the FTP data channel corresponding to the command; and adding the obtained quintuple information of the FTP data channel to an FTP file transmission list. The saving module is configured to save original packets of non-pre-set protocols and save file index information of original packets corresponding to the quintuple information; comprising: reading mirror traffic packet by packet to form an original packet stream and filtering the mirror traffic according to the pre-set protocol; for a case where a current original packet is not a packet of a pre-set protocol, saving the current original packet to a packet file and writing index information of a file where the original packet corresponding to the quintuple is located into a database. The processing module is configured to, when a file needs to be restored, query file index information of original packets according to quintuple information, acquire original packets of an FTP data channel according to the queried file index information, generate a target file from data obtained after flow recombination of the original packets; wherein the processing module is configured to, when a file needs to be restored, query file index information of original packets according to quintuple information, generate a target file from data obtained after flow recombination of the original packets, comprising: triggering a timing task, traversing the FTP file transmission list, querying packet index information of the original packets according to the quintuple in the FTP file transmission list, positioning and reading all original packets according to the queried packet index, executing TCP flow recombination, extracting a payload of the FTP data channel, and writing data after recombination into the target file to restore the TPF file.

Images