when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on the main storage. basically what i want to ask is: are data packets stored individually on a computer one by one or all together? and can this data be recovered and viewed? according to my limited knowledge using a packet capture software the protocol it says that is being used is: tcp.so will a person trying to recover suffer from desynchronisation
There is no single way these data will be handeled, i.e. it depends on the application receiving the data:
- If you have for example a web application with some way to upload data these data will probably be accumulated first into some temporary file on disk in some default or configuration dependent folder. Of course "on disk" might also be a RAM disk in which case the data are only in memory. But, if the connection closes (i.e. upload aborted) the data will usually deleted in which case they might still remain as bytes in some free space on the disk. And, some web applications might also accumulate the data just in memory, i.e. nothing gets written on disk.
- If you have an FTP server instead and upload a file it gets usually transferred directly on the place where the client wants it to be, i.e. no temporary file and no cleanup. But of course, details vary by FTP server implementation.
- With rsync you get again usually temporary files which usually get cleaned up on connection close.
- ... and different behavior for different applications
What is common for all storage done at the application level is that not the packets but the data will be stored, since a TCP based application has no idea of packet boundaries. This can be different with UDP based applications since with UDP a packet boundary is a message boundary (ignoring fragmented packets). But, UDP is usually not used for file transfer.
TCP is the most common protocol for internet communication as it is reliable (no data loss because a packet or two went missing) unlike other faster protocols like UDP (something that might be used for voice data, where its more important to keep the stream going than replay a 0.1s burst of static).
Are data packets stored individually ...? and can this data be recovered and viewed?
TCP packets will never be stored on disk. Usually, an application will cache some data into memory, and if its a big file periodically flush online cache to the hard disk. So for example, you transfer 3.2mb data and connection breaks - maybe 3mb is saved to a temporary file while last 0.2mb was only in memory cache.
In this case, you can search for the 3mb file either in the actual download location or as a temporary file (different OS have differing places to store these). The in-memory data can't be retrieved once the downloading app has crashed.
will a person trying to recover suffer from desynchronisation
If the app allows you to resume, e.g. download managers, then it is also smart enough to properly request any missing data from the server.