File extraction from network data to artifact store files and file reconstruction

A method of extracting file content from a live stream of network data streaming multiple files, the method comprising:

• receiving artifact chunks, each artifact chunk including a portion of file content of a file of the multiple files as identified by deep packet inspection (DPI) at first capture of the network data;
• storing the artifact chunks in an artifact chunk section of an artifact store for linearly storing the artifact chunks in an order as received;
• storing artifact chunk information (ACI) for each artifact chunk in a chunk table section of the artifact store, the ACI identifying the artifact chunk, identifying another artifact chunk of the file, and identifying a location of the artifact chunk in the artifact chunk section;
• and
• storing a unique artifact locator identifier (ALI) that uniquely identifies a storage location within the artifact store of an artifact chunk associated with file, wherein the ALI and ACI associated with the artifact chunks are configured with the ability to locate each artifact chunk associated with the file that is stored in the artifact store for future reconstruction of the file, wherein the artifact store is capable of including multiple artifact store files, each artifact store file having an artifact chunk section and a chunk table section, wherein receiving the artifact chunks includes receiving multiple threads of artifact chunks, each artifact store file being associated with only one thread of the multiple threads for storing artifact chunks of the thread into the artifact chunk section and storing corresponding ACI in the chunk table section of the artifact store file and wherein each artifact store file includes a header that stores identification information that uniquely identifies the artifact store file, and whereby an artifact store file of the multiple artifact store files is deleted based on the identification information included in the header.