RedSplice

Content Extraction

Starting from session reconstruction, RedSplice is capable of extracting the information available in the packets and put it in a form that is easy to visualize and understand. Content extraction is available for HTTP based traffic and it will allow the user to directly view content like images, videos, flash files and javascript content.

Binary content that cannot be displayed directly in the application, will be saved on the disk wherethe user can access it via Windows Explorer or any other file browser. In order to have unknown binary content saved on the disk and see the path where the content is saved, one must use the HTML View option in Smart View. HTML View will provide full visibility over raw HTTP requests as well as a detailed view over HTML, XML, JSON and Javascript content even if they are encoded using gzip.

Using Content View,one can navigate through the entire decoded content using the ‘All’ option. Using the integrated content navigator the user is capable to skip from one item to another as well as to inspect scripts in the script viewer or play video content in the embedded video player.
It must be noted that the entire content will be saved on the disk from the initial raw packets captured from the network. So, when previewing the content, RedSplice will load it from the disk and not from the server. This way it is ensured the fact that later, when analyzing the data captured, one would analyze/visualize the data captured and not the updated data on the server.