diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 5b8cf67a08..d974a16188 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -912,12 +912,12 @@ void TransportLayerAnalyzer::Done()
 	}
 
 void TransportLayerAnalyzer::SetContentsFile(unsigned int /* direction */,
-						BroFile* /* f */)
+						IntrusivePtr<BroFile> /* f */)
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	}
 
-BroFile* TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
+IntrusivePtr<BroFile> TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	return nullptr;
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index 859c5400e2..76ef088633 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -911,7 +911,7 @@ public:
 	 * @param f The file to record to.
 	 *
 	 */
-	virtual void SetContentsFile(unsigned int direction, BroFile* f);
+	virtual void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f);
 
 	/**
 	 * Returns an associated contents file, if any.  This must only be
@@ -921,7 +921,7 @@ public:
 	 * @param direction One of the CONTENTS_* constants indicating which
 	 * direction the query is for.
 	 */
-	virtual BroFile* GetContentsFile(unsigned int direction) const;
+	virtual IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const;
 
 	/**
 	 * Associates a PIA with this analyzer. A PIA takes the
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index 3c30638692..9734ea30cb 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -1584,7 +1584,7 @@ void TCP_Analyzer::ConnDeleteTimer(double t)
 	Conn()->DeleteTimer(t);
 	}
 
-void TCP_Analyzer::SetContentsFile(unsigned int direction, BroFile* f)
+void TCP_Analyzer::SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f)
 	{
 	if ( direction == CONTENTS_NONE )
 		{
@@ -1601,7 +1601,7 @@ void TCP_Analyzer::SetContentsFile(unsigned int direction, BroFile* f)
 		}
 	}
 
-BroFile* TCP_Analyzer::GetContentsFile(unsigned int direction) const
+IntrusivePtr<BroFile> TCP_Analyzer::GetContentsFile(unsigned int direction) const
 	{
 	switch ( direction ) {
 	case CONTENTS_NONE:
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index f8b668b35a..2100eda181 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -60,8 +60,8 @@ public:
 	// the test is whether it has any outstanding, un-acked data.
 	bool DataPending(TCP_Endpoint* closing_endp);
 
-	void SetContentsFile(unsigned int direction, BroFile* f) override;
-	BroFile* GetContentsFile(unsigned int direction) const override;
+	void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f) override;
+	IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const override;
 
 	// From Analyzer.h
 	void UpdateConnVal(RecordVal *conn_val) override;
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index a798c28fb2..272bc0b563 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -29,7 +29,6 @@ TCP_Endpoint::TCP_Endpoint(TCP_Analyzer* arg_analyzer, bool arg_is_orig)
 	FIN_seq = 0;
 	SYN_cnt = FIN_cnt = RST_cnt = 0;
 	did_close = false;
-	contents_file = nullptr;
 	tcp_analyzer = arg_analyzer;
 	is_orig = arg_is_orig;
 
@@ -53,7 +52,6 @@ TCP_Endpoint::TCP_Endpoint(TCP_Analyzer* arg_analyzer, bool arg_is_orig)
 TCP_Endpoint::~TCP_Endpoint()
 	{
 	delete contents_processor;
-	Unref(contents_file);
 	}
 
 Connection* TCP_Endpoint::Conn() const
@@ -254,10 +252,9 @@ void TCP_Endpoint::AckReceived(uint64_t seq)
 		contents_processor->AckReceived(seq);
 	}
 
-void TCP_Endpoint::SetContentsFile(BroFile* f)
+void TCP_Endpoint::SetContentsFile(IntrusivePtr<BroFile> f)
 	{
-	Ref(f);
-	contents_file = f;
+	contents_file = std::move(f);
 	contents_start_seq = ToRelativeSeqSpace(last_seq, seq_wraps);
 
 	if ( contents_start_seq == 0 )
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.h b/src/analyzer/protocol/tcp/TCP_Endpoint.h
index e72016e4a2..9e90f0919d 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.h
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.h
@@ -3,8 +3,8 @@
 #pragma once
 
 #include "IPAddr.h"
+#include "File.h"
 
-class BroFile;
 class Connection;
 class IP_Hdr;
 
@@ -187,8 +187,8 @@ public:
 
 	void AckReceived(uint64_t seq);
 
-	void SetContentsFile(BroFile* f);
-	BroFile* GetContentsFile() const	{ return contents_file; }
+	void SetContentsFile(IntrusivePtr<BroFile> f);
+	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return contents_file; }
 
 	// Codes used for tracking history.  For responders, we shift these
 	// over by 16 bits in order to fit both originator and responder
@@ -211,7 +211,7 @@ public:
 	TCP_Endpoint* peer;
 	TCP_Reassembler* contents_processor;
 	TCP_Analyzer* tcp_analyzer;
-	BroFile* contents_file;
+	IntrusivePtr<BroFile> contents_file;
 	uint32_t checksum_base;
 
 	double start_time, last_time;
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index 9ff61bf66a..5f70e02560 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -30,7 +30,6 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 	type = arg_type;
 	endp = arg_endp;
 	had_gap = false;
-	record_contents_file = nullptr;
 	deliver_tcp_contents = false;
 	skip_deliveries = false;
 	did_EOF = false;
@@ -58,11 +57,6 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 		}
 	}
 
-TCP_Reassembler::~TCP_Reassembler()
-	{
-	Unref(record_contents_file);
-	}
-
 void TCP_Reassembler::Done()
 	{
 	MatchUndelivered(-1, true);
@@ -98,7 +92,7 @@ uint64_t TCP_Reassembler::NumUndeliveredBytes() const
 	return last_block.upper - last_reassem_seq;
 	}
 
-void TCP_Reassembler::SetContentsFile(BroFile* f)
+void TCP_Reassembler::SetContentsFile(IntrusivePtr<BroFile> f)
 	{
 	if ( ! f->IsOpen() )
 		{
@@ -107,16 +101,17 @@ void TCP_Reassembler::SetContentsFile(BroFile* f)
 		}
 
 	if ( record_contents_file )
+		{
 		// We were already recording, no need to catch up.
-		Unref(record_contents_file);
+		record_contents_file = nullptr;
+		}
 	else
 		{
 		if ( ! block_list.Empty() )
 			RecordToSeq(block_list.Begin()->second.seq, last_reassem_seq, f);
 		}
 
-	Ref(f);
-	record_contents_file = f;
+	record_contents_file = std::move(f);
 	}
 
 static inline bool is_clean(const TCP_Endpoint* a)
@@ -322,7 +317,7 @@ void TCP_Reassembler::MatchUndelivered(uint64_t up_to_seq, bool use_last_upper)
 		}
 	}
 
-void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile* f)
+void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f)
 	{
 	auto it = block_list.Begin();
 
@@ -353,7 +348,7 @@ void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile
 			RecordGap(last_seq, stop_seq, f);
 	}
 
-void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f)
+void TCP_Reassembler::RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write((const char*) b.block, b.Size()) )
 		return;
@@ -368,7 +363,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f)
 		);
 	}
 
-void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* f)
+void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write(fmt("\n<<gap %" PRIu64">>\n", upper_seq - start_seq)) )
 		return;
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index dffa55445a..1ff6b835d1 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -3,8 +3,8 @@
 #include "Reassem.h"
 #include "TCP_Endpoint.h"
 #include "TCP_Flags.h"
+#include "File.h"
 
-class BroFile;
 class Connection;
 
 namespace analyzer {
@@ -25,8 +25,6 @@ public:
 	TCP_Reassembler(Analyzer* arg_dst_analyzer, TCP_Analyzer* arg_tcp_analyzer,
 	                Type arg_type, TCP_Endpoint* arg_endp);
 
-	~TCP_Reassembler() override;
-
 	void Done();
 
 	void SetDstAnalyzer(Analyzer* analyzer)	{ dst_analyzer = analyzer; }
@@ -51,8 +49,8 @@ public:
 	// from waiting_on_hole above; and is computed in a different fashion).
 	uint64_t NumUndeliveredBytes() const;
 
-	void SetContentsFile(BroFile* f);
-	BroFile* GetContentsFile() const	{ return record_contents_file; }
+	void SetContentsFile(IntrusivePtr<BroFile> f);
+	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return record_contents_file; }
 
 	void MatchUndelivered(uint64_t up_to_seq, bool use_last_upper);
 
@@ -91,9 +89,9 @@ private:
 	void Undelivered(uint64_t up_to_seq) override;
 	void Gap(uint64_t seq, uint64_t len);
 
-	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile* f);
-	void RecordBlock(const DataBlock& b, BroFile* f);
-	void RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* f);
+	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f);
+	void RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f);
+	void RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f);
 
 	void BlockInserted(DataBlockMap::const_iterator it) override;
 	void Overlap(const u_char* b1, const u_char* b2, uint64_t n) override;
@@ -110,7 +108,7 @@ private:
 	bool in_delivery;
 	analyzer::tcp::TCP_Flags flags;
 
-	BroFile* record_contents_file;	// file on which to reassemble contents
+	IntrusivePtr<BroFile> record_contents_file;	// file on which to reassemble contents
 
 	Analyzer* dst_analyzer;
 	TCP_Analyzer* tcp_analyzer;
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index 461f7a510e..043dbbdafa 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -101,7 +101,7 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
 	if ( ! c )
 		return val_mgr->False();
 
-	c->GetRootAnalyzer()->SetContentsFile(direction, f);
+	c->GetRootAnalyzer()->SetContentsFile(direction, {NewRef{}, f});
 	return val_mgr->True();
 	%}
 
@@ -127,7 +127,7 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 		auto cf = c->GetRootAnalyzer()->GetContentsFile(direction);
 
 		if ( cf )
-			return make_intrusive<Val>(IntrusivePtr{NewRef{}, cf});
+			return make_intrusive<Val>(std::move(cf));
 		}
 
 	// Return some sort of error value.