Which sequence describes the steps to extract a JPEG from a capture in Wireshark?

• A. Right-click the JPEG header, choose Export Packet Bytes, save as All Files with a JPEG extension
• B. Use Copy, then Paste into a text editor and save
• C. Use File > Save As and change the extension
• D. Right-click packet, Copy As Attached Data and save

Answer: (A)

This relies on extracting the exact binary payload that makes up the image from the capture. In Wireshark, you can target the packet that contains the JPEG, right-click the JPEG header within that packet, and choose Export Packet Bytes. Saving those bytes with a .jpg (or .jpeg) extension preserves the binary data so a viewer can open it as a valid image. This approach isolates the image data without pulling in non-image text or reformats, which would happen if you copied the data into a text editor (risking corruption) or used a generic Save As that doesn’t capture just the image payload. If the JPEG spans multiple packets, you’d first reassemble the stream (Follow TCP Stream) and then export the resulting bytes, but the standard method starts with exporting the bytes from the packet containing the JPEG header.