Flow records show a workstation sent 4 GB to an unknown external host over unencrypted FTP overnight. Legal asks for evidence of exactly which files and content left the network. Which data source can provide that?
Select an answer to reveal the explanation.
Short Explanation
If flow records are the phone bill, a packet capture is the recording of the call. Legal wants to hear what was said, so you need the recording. Don't let the flow data fool you; it knows a big conversation happened, but not a single word of it.
Full Explanation
Flow telemetry records metadata about conversations, including addresses, ports, timing and byte counts, but discards payload. It is ideal for spotting that a large transfer happened and between which hosts, and it is often the trigger for deeper investigation. Answering which files and what content left requires the payload itself, which only full packet capture retains. Because FTP control and data channels are unencrypted, a capture of the session allows analysts to reconstruct commands such as file names and to carve the transferred files from the data connection. The trade-off is storage: captures are large, so they are typically retained briefly or captured on demand at chosen points. Flow records do not contain file names or content, no matter how detailed the export. SNMP traps signal device events such as interface or threshold changes; routers do not emit a trap per FTP file. DNS logs show name resolutions, perhaps the hostname of the server, but file transfers are not DNS queries and no file names appear there. Exam caveat: if the session had been encrypted, such as SFTP or FTPS, payload content would be unreadable in a capture without the keys, leaving only metadata. Operational check: confirm a capture source covering the workstation's egress path exists and its retention window still holds the overnight session before exporting it for legal review.