Getting Started

This section demonstrates how to setup, start, stop and browse sessions.

1. Start the DataEcho executable.

2. When DataEcho is running select the Set Storage Location menu item or button on the button bar. This will determine where DataEcho will store the reconstructed session and session tree. (This must be done before a capture can be started.)

3. If a previous session capture has been saved in the location Load the previous session tree before continuing. (Optional.)

4. Next use the Set Filters option to filter the capture by TCP/IP address/s and/or port/s. (Optional.)

5. Select either a network device or PCAP file to capture and reconstruct sessions from. (This must be done before a capture can be started.)

6. Start the capture session.

7. Wait for the file capture to stop or stop the device capture with the appropriate menu item.

8. Wait for all activity to halt in the session tree pane.

9. Save the session tree before browsing.

10. Browse the reconstructed session using the Reconstructed Session Navigation Tree.

11. Exit program making sure the session tree has been saved.