packet capture tools

Fax Image Extractor

The Fax Image Extractor helps support teams recover viewable fax images or documents from packet captures without uploading customer data. It scans the capture in the browser and creates downloads when recognizable image or document bytes are present.

What It Extracts

Recoverable TIFF fax pages when a complete file-like payload exists.
PDF documents when a recognizable PDF payload is present.
JPEG or PNG images embedded in packet payload data.
Basic file metadata such as size, dimensions, TIFF resolution, TIFF compression, or PDF page count when available.

When To Use It

Use it when someone sends you a fax-related PCAP and you want to see whether the capture contains a recoverable page or document without opening a full packet analyzer.

How To Read Results

Download any extracted files and confirm whether the page content is useful before sharing it.
Dimensions and resolution metadata can help explain whether the recovered image is standard fax quality or unusually small.
No extracted file does not prove the fax had no page image; some captures store page data as raw fax chunks rather than a complete viewable file.
Use PCAP Redactor before sending captures or extracted evidence to a customer.

Limits

This tool extracts recognizable file payloads. It does not yet rebuild a fax page from low-level raw fax image chunks when the capture does not contain a complete TIFF, PDF, JPEG, or PNG-style file.

How To Use Fax Image Extractor

Upload a PCAP or PCAPNG that may contain fax traffic.
Let TraceRoo scan packet payloads locally for recognizable image or document bytes.
Download any extracted TIFF, PDF, JPEG, or PNG files.
Verify page content, dimensions, and resolution before sending evidence to someone else.
If no image is extracted, use a deeper fax decoder or the sending/receiving system logs for full page reconstruction.

Example Result

Recovered TIFF page PCAP containing recognizable TIFF bytes inside fax payload data

TIFF file extracted Width and height shown Resolution shown when present

Open the downloaded image to confirm content.
Redact sensitive customer data before sharing evidence.

No standalone image found PCAP with fax traffic but no complete TIFF, PDF, JPEG, or PNG payload

No extractable fax image found

The fax page may still exist as raw fax image chunks.
Use a deeper fax decoder or endpoint/gateway logs if you need full page reconstruction.

FAQ

Why did it not extract an image?

Many fax captures do not contain a complete standalone image file. They may carry lower-level fax image chunks that need a deeper fax decoder before a viewable page can be rebuilt.

What file types can it recover?

The extractor looks for TIFF, PDF, JPEG, and PNG signatures and shows basic metadata when the file format makes that easy to read.

Does the PCAP upload to TraceRoo?

No. The browser reads the capture locally and creates any extracted file downloads inside the browser session.