Recovering a file that was sent via FTP is unique to a file sent over other Ports or Protocols e.g. SMTP/25, SSH/22, HTTP/80 etc, because FTP sends the file over higher ports that create a new and unique Session ID.
Port 21/tcp FTP Command Session
Port 20/tcp FTP Data Session
In the attached document we follow a session between two hosts that use multiple ports and session ID's to recover the PDF document that was transmitted.
