A student on a city lab engagement saves only ASCII terminal logs and discards PCAP files. Why is that a problem for wireless evidence?
Select an answer to reveal the explanation.
Short Explanation
A terminal scrapbook is a highlight reel; a PCAP is the game film. Later you can re-check whether the handshake was complete and inspect real frame fields. Text alone leaves the coach guessing.
Full Explanation
Saving only ASCII terminal logs while discarding PCAP files is a problem because PCAPs allow re-analysis of handshake completeness and protocol fields that text logs cannot fully preserve. Municipal wireless evidence needs packets for EAPOL message counts, IE contents, timestamps, and independent verifier review. Terminal scrollbacks are helpful narrative, not a complete substitute for binary captures that civic auditors may re-open months later. Saying ASCII logs always include full encrypted PTK material suitable for reuse fails by concept: PTKs are not reliably dumped as reusable key material in ordinary terminal text, and logs are not a keystore. Claiming terminal text is preferred because captures cannot show SSID names fails by concept: PCAPs show SSIDs and far more protocol detail. Asserting PCAPs are useless once any airodump screenshot exists fails by concept: screenshots lack frame-level re-analysis power and cannot prove handshake message completeness. Exam caveat: retain both—screenshots for readability in civic reports and PCAPs for technical depth and chain-of-custody—rather than choosing one exclusive evidence form. Operational check: configure disk capture for every municipal wireless test, verify the pcap contains the claimed handshake, keep the ASCII log as a timeline, hash both artifacts, and submit them together in the evidence bundle.