Patent ID: 8849991

Claim:
A method of hypertext transfer protocol layered reconstruction comprising: querying, utilizing at least one processing unit, at least one database to identify at least one of a location of packet data of a hypertext markup language file in a packet capture repository or a location of a previously reconstructed artifact of the hypertext markup language file, the packet capture repository storing network packet data, the database indexed by content analysis and inspection of the network packet data to point to at least one location of the network packet data in the packet capture repository according to at least one of artifact types of the network packet data, protocol types of the network packet data, or time stamps of the network packet data; selecting a subset of the network packet data based on the time stamps of the network packet data and time stamps of at least one of the packet data of the hypertext markup language file or the previously reconstructed artifact of the hypertext markup language file; identifying, utilizing the at least one processing unit, at least one external link in the hypertext markup language file; identifying, utilizing the at least one processing unit, at least one additional external link in the hypertext markup language file; querying, utilizing the at least one processing unit, the at least one database to determine that external file packet data of an additional external file associated with the at least one additional external link is not located in the packet capture repository and was not previously reconstructed; querying, utilizing the at least one processing unit, the at least one database to identify at least one of a location of external file packet data of an external file in the packet capture repository associated with the at least one external link or a location of a previously reconstructed artifact of the external file; and reconstructing, utilizing the at least one processing unit, a web page based on at least the hypertext markup language file and the external file, wherein reconstructing includes determining a first available external file type that the reconstructed web page can include and a second available external file type that the reconstructed web page cannot include to avoid potential network damage from malicious code, wherein a placeholder is used as a substitute for the second available external file type, wherein the reconstructed web page is based on a version of the additional external file obtained from the at least one additional external link instead of at least one of the packet capture repository or the previously reconstructed artifact of the external file.