A student on a city lab engagement saves only ASCII terminal logs and discards PCAP files. Why is that a problem for wireless evidence?
Select an answer to reveal the explanation.
Short Explanation
A terminal scrapbook is a highlight reel; a PCAP is the game film. Later you can re-check whether the handshake was complete and inspect real frame fields. Text alone leaves the coach guessing.
Full Explanation
Binary packet captures preserve 802.11/EAPOL structures needed to verify handshake completeness, timestamps, addresses, and related protocol details during re-analysis or reporting disputes. ASCII tool output is helpful narrative but incomplete as sole evidence. Screenshots of survey tools likewise do not replace PCAPs when frame-level proof matters for OSWP-style methodology.