Wireshark Part 11 — Preserve incident evidence and share the minimum necessary

Preserve original captures, reconstruct known teaching objects, and prepare a minimal, documented evidence extract.

Series index · Previous: Voice and media · Next: Repeatable workflows

The Hardware Ledger · 18 September 2026. Official documentation source-checked. This exercise has not been hardware-tested; it is a practice workflow, not a claim of forensic certification or guaranteed legal admissibility.

Question: Can another analyst reproduce your finding without receiving the whole capture or losing track of the original evidence?

Outcome: A preserved original, a documented timeline, and a separately reviewed evidence extract.

The legitimate use is making an authorized investigation reproducible. The harmful use is harvesting private documents, publishing credentials, or selectively editing packets to create a misleading story. Keep the unmodified original separate from working copies. Clearly label every derivative and describe omissions. Never present an extract as the complete record.

Prepare the practice material

Use an instructor-prepared PCAP containing a known harmless HTTP text-file transfer between disposable lab endpoints. Ask for the original text file or its expected SHA256 digest and transfer frame range. This deliberately simple dataset lets you verify object recovery without handling unknown content. An existing lab trace is sufficient; no new network capture is required.

To create your own equivalent dataset, reuse the loopback-only server setup from Part 05. Place a harmless training.txt in its otherwise empty server folder, record that file’s SHA256, capture loopback while requesting http://127.0.0.1:8000/training.txt with curl.exe --noproxy "*", and stop both capture and server. Save the resulting capture separately and use the text file’s hash as the expected object digest. Keep the server bound to 127.0.0.1; no credentials are needed for this transfer.

Work in a restricted local directory outside automatic sharing/synchronization. Prepare separate original, working, and review folders. Record who supplied the capture, when you received it, the approved purpose, and the source capture point. For a real incident, use the organization’s evidence retention and handling procedure.

Build a reproducible evidence package

  1. Fingerprint and copy. Preserve the received file as original\training.pcapng. In PowerShell, with your practice directory as the current directory, run:

    Get-FileHash -LiteralPath '.\original\training.pcapng' -Algorithm SHA256
Copy-Item -LiteralPath '.\original\training.pcapng' -Destination '.\working\training.pcapng'
Get-FileHash -LiteralPath '.\working\training.pcapng' -Algorithm SHA256

    Record both digests and confirm equality. SHA256 helps detect changes to file contents; a matching digest does not establish where the file came from or whether its captured events are truthful. Keep the recorded digest separately from the editable working copy. Microsoft Get-FileHash documentation

  2. Record capture context. Open only the working copy. Under Statistics → Capture File Properties, record its time span, interface information, and available capture metadata. Note any supplied clock offset or missing capture details. Record the Wireshark version. Do not silently correct timestamps in the original. Capture File Properties

  3. Construct the timeline. Set View → Time Display Format → Seconds Since Epoch for an unambiguous UTC-based time reference. Apply http.request or http.response and identify the known transfer. If HTTP is not decoded, follow Part 05’s Decode As recovery using the known training server port, then restore the HTTP filter. Select a transfer packet, expand TCP, note its stream index, and use tcp.stream == N, replacing N. Record the request, response, and completion or last observed packet, including original frame numbers and epoch times. Time-display changes alter presentation; they do not repair an inaccurate capture clock. Time formats

  4. Recover only the known teaching object. Choose File → Export Objects → HTTP. Locate the instructor-specified text object by filename, size, and packet reference; select it and choose Save into review. Avoid Save All, which also exports objects hidden by the dialog’s text filter. Hash the saved file and compare it with the supplied expected digest. Do not open or run unknown objects, trust filename extensions, or treat an HTTP content type as a safety verdict. Export Objects

  5. Create a scoped packet extract. With the relevant tcp.stream == N displayed, use File → Export Specified Packets and explicitly choose the displayed packet range. Save as review\transfer-extract.pcapng. Reopen it and verify that it still contains the necessary request, response, and transfer context. Derivative frame numbers may differ; keep the original frame references in your worksheet. Packet export controls

  6. Remove embedded secrets and comments from a review copy. PCAPNG can contain decryption secrets, not just packets. Locate Wireshark’s installed editcap tool; the following PowerShell example uses the usual Windows installation path. Adjust it if necessary:

    $editcapPath = Join-Path $env:ProgramFiles 'Wireshark\editcap.exe'
& $editcapPath --help

    Confirm that your version supports all three discard options below, then create a new review file. Use a new filename if the destination already exists:

    & $editcapPath --discard-all-secrets --discard-capture-comment --discard-packet-comments '.\review\transfer-extract.pcapng' '.\review\transfer-review.pcapng'

    Check the diagnostics and $LASTEXITCODE before proceeding. If the tool or options are unavailable, record the limitation; do not report secrets as removed. Successful processing removes the specified secret blocks and comments; it is not anonymization. Addresses, payload credentials, names, interface metadata, and other sensitive information can remain. Editcap manual

  7. Review the proposed handoff. Reopen transfer-review.pcapng. Check protocol details, readable payload, remaining metadata, and the exact packet range. Prefer a minimal timeline or redacted screenshot if raw packets are unnecessary. A display filter only changes the view; it does not sanitize the file. Hash the final derivative and describe the original digest, selection filter, transformations, remaining sensitivity, and intended recipients. Keep the package local until the authorized sharing route is established.

Interpret and protect

A missing or mismatched exported object may indicate an incomplete capture, unavailable decryption, unsupported reconstruction, or the wrong object selection. It does not by itself prove evidence tampering. An exported file’s hash and the capture’s hash are hashes of different byte sequences; they should not be expected to match.

State exactly what the evidence supports: “these captured bytes reconstructed the known training file.” Do not turn that into “the person read the file” or “the entire transfer completed at the application.” Maintain an access and transfer record for real incident material, and apply the agreed retention period to originals, extracts, screenshots, hashes, and notes.

Completion criterion: Another learner can locate your cited events in the preserved capture, reproduce the known object’s digest, and explain every difference between the original and the proposed shared derivative. Nothing unknown has been executed, and nothing has been published.