hi there

1- SMBspy is dead , there is no homepage , and i couldnt manage to find a copy of the program . anybody out there has a copy ?

2- is there anyone out there experienced SMBsniffer with success ? any alternative ?

3- to finish my paper there is only one task , reconstruction of SMB transfered files , live or using dump file formats like pcap , any sample code in C or Ruby is appreciated , also any hint lead me to a working solution

4- there are some words about dumping files , but i never found anything regarding prints ? why ? arent they transferring over SMB when we are using SAMBA or a shared windows network ?

-- best regards

I'm pretty sure tcpflow can extract files from sessions. Just run it and then do file * to see what files they are. tcpextract can also do it, but it is somewhat buggy. Then there is also foremost which can be run on a pcap file. Check out http://geek00l.blogspot.com/search?q=foremost for more info.

thanks,
i had some experiences with tcpxtract but it was somehow unreliable , specially when i came to PDF ot office formats , will give tcpflow a try .

what about "print"s ? anny idea on this one ?
anybody ever recovered a sent-to-printer document over SMB ?

nobody have a copy of smbspy ? why did project died and now its erased from the earth ??

anybody know of any other project in this regard ? any experience to share ?