Captured downloads
A page can offer a file for download while an analyst drives the disposable browser. livewells captures the file, checks it and shows it in the case.
What an analyst sees
- A notice on the live page for each file: "File captured: invoice.pdf (PDF, 1.2 MiB). Analysis started."
- A Chain section on the case page. It lists the first link, each redirect and the file, in that order.
- Under each file, the items that the file holds. Each item shows its type, its size and its findings.
- Links that livewells finds inside a file. Choose Start a case for this link to open one in its own case.
Each file in the chain shows one state:
| State | Meaning |
|---|---|
| Analysing | livewells is reading the file. |
| Queued, waiting for a free analysis slot | livewells stored the file. The analysis starts when your organisation has room in its starts in 15 minutes. |
| Done | The report is ready. |
| Needs a password | The file is locked. Send the password on the case. |
| Not captured | The session ended before the download finished. |
| Not analysed | The file is too large, or the case reached a limit. |
| Copy of a file above | The case holds the first copy of this file. |
A captured file is an item of the case and costs no submission. The case shows how many files it holds, for example "Captured files: 3 of 10."
HTML files
For a captured HTML file, the chain offers Open in a disposable browser. That run starts its own session and uses one submission. The session shows in the chain under the file. Choose Show this session to open it.
Download the original
An analyst can download the original of a captured file as a sample. See Cases.
Limits
| Limit | Value |
|---|---|
| Captured files in one case | 10 |
| Depth of the chain | 3 steps |
| Size of one captured file | 25 MiB |
A file over 25 MiB appears in the chain with its SHA-256. livewells records the SHA-256 of a file over 25 MiB and stops there. A file past the other limits appears with the reason.
Each file check counts as one start in the starts in 15 minutes of your organisation. When a session captures more files than that limit allows, livewells keeps the stored files and starts each analysis when a start leaves the 15 minutes. A file waits up to 60 minutes for a free slot. After that, the file shows that livewells did not check it because your organisation reached its limit of starts in 15 minutes.
The retention period of your organisation applies to captured files.