when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on the main storage. basically what i want to ask is: are data packets stored individually on a computer one by one or all together? and can this data be recovered and viewed? according to my limited knowledge using a packet capture software the protocol it says that is being used is: tcp.so will a person trying to recover suffer from desynchronisation


There is no single way these data will be handeled, i.e. it depends on the application receiving the data:

  • If you have for example a web application with some way to upload data these data will probably be accumulated first into some temporary file on disk in some default or configuration dependent folder. Of course "on disk" might also be a RAM disk in which case the data are only in memory. But, if the connection closes (i.e. upload aborted) the data will usually deleted in which case they might still remain as bytes in some free space on the disk. And, some web applications might also accumulate the data just in memory, i.e. nothing gets written on disk.
  • If you have an FTP server instead and upload a file it gets usually transferred directly on the place where the client wants it to be, i.e. no temporary file and no cleanup. But of course, details vary by FTP server implementation.
  • With rsync you get again usually temporary files which usually get cleaned up on connection close.
  • ... and different behavior for different applications

What is common for all storage done at the application level is that not the packets but the data will be stored, since a TCP based application has no idea of packet boundaries. This can be different with UDP based applications since with UDP a packet boundary is a message boundary (ignoring fragmented packets). But, UDP is usually not used for file transfer.

  • so you mean that if tcp is used then the payload of the packets wont be stored onto the main disk?
    – user119042
    Aug 3 '17 at 2:57
  • how would an apache server handle the data
    – user119042
    Aug 3 '17 at 3:09
  • @sweetpunk: no, I mean that most web applications store uploaded data in temporary files first, which might be on the main disk or not - depending on defaults and configuration. But some might also store the data in memory only. And - it depends on the application (or features of mod_php and similar) and not on the web server itself. Aug 3 '17 at 4:28
  • and is there any rule according to which packets of picture are stored? or that also depends upon the server configuration
    – user119042
    Aug 3 '17 at 5:40
  • @sweetpunk: the application can of course at most store the data it received. But in case it stores the data of an image at all it would make no sense to explicitly omit some data in between because then you would have an invalid (and thus useless) image. Of course if the application is not storing the original image but processing it during upload already it might store a modified version, like with any comments and EXIF data already stripped. But again, the application usually does not work in terms of packets at all. Aug 3 '17 at 6:05

TCP is the most common protocol for internet communication as it is reliable (no data loss because a packet or two went missing) unlike other faster protocols like UDP (something that might be used for voice data, where its more important to keep the stream going than replay a 0.1s burst of static).

Are data packets stored individually ...? and can this data be recovered and viewed?

TCP packets will never be stored on disk. Usually, an application will cache some data into memory, and if its a big file periodically flush online cache to the hard disk. So for example, you transfer 3.2mb data and connection breaks - maybe 3mb is saved to a temporary file while last 0.2mb was only in memory cache.

In this case, you can search for the 3mb file either in the actual download location or as a temporary file (different OS have differing places to store these). The in-memory data can't be retrieved once the downloading app has crashed.

will a person trying to recover suffer from desynchronisation

If the app allows you to resume, e.g. download managers, then it is also smart enough to properly request any missing data from the server.

  • so where is this data that u say is stored temporarily, on the main hard drive?so when we run recovery test on the server memory will they appear.
    – user119042
    Aug 3 '17 at 2:55
  • The data location depends on the application trying to save it and the OS conventions. Idk how to recover from server memory, though I'm sure there are tools to do so to some extent.
    – Alok
    Aug 3 '17 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy