use autopsy to get back deleted pcap file and open it by wireshark and use voip option to get audio where flag is existed.