This paper presents a network flow recovery method that focuses on recovering network flow to a file. The proposed method utilizes a two-stage parallel strategy to maximize the processing efficiency of multi-core computers. It involves acquiring high-speed flow, splitting the flow using Mac address xor and IP address xor methods, and resolving the initial flow into multiple thin flows