A hospital analyst has three records for three different questions: a packet capture, an exported flow record, and a mail-filter verdict. Which record can recover a file from an unencrypted download?
Select an answer to reveal the explanation.
Short Explanation
You cannot rebuild a letter from the weight of the envelope. Only the packet capture still holds the bytes of this unencrypted download. A flow summary, a mail verdict, and a severity vector answer other questions.
Full Explanation
Recovering a file means reassembling the bytes that crossed the wire. The full packet capture of the unencrypted transfer, reassembled so the downloaded file bytes can be carved out, is the only one of these records that still holds that content. The exported flow record, a summary of addresses, ports, and byte counts with no file bytes inside, can show that a transfer happened and how large it was, and it stops before the file itself. The mail-filter verdict on a message that used a different channel than this unencrypted download judges a mail message, not this download. A CVSS vector that rates a software flaw and contains none of the bytes from the transferred file is a severity description, not a copy of the object. Exam caveat: had the transfer been encrypted, the same capture would show ciphertext rather than a readable file; this transfer is unencrypted, so the bytes are recoverable. Operational check: follow the TCP stream or export the HTTP objects from the capture and compare the carved file with the download the analyst is tracing.