Tor Browser Forensics DFE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In Tor's onion routing, what is the primary purpose of the entry (guard) node?

   • ATo decrypt the final layer and deliver the traffic to the destination server
   • BTo maintain a public list of all Tor relays for client discovery
   • CTo serve as the first hop that receives the client's traffic and forwards it to the next relay
   • DTo encrypt the data multiple times before it enters the Tor network
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic examiner has acquired a memory dump from a suspect's computer. The suspect was using Tor Browser to access a dark web marketplace. The examiner wants to recover the plaintext of a page that was open in the browser at the time of acquisition. Which approach is most likely to yield the desired evidence?

   • ACheck the tor log file for the URLs visited.
   • BExamine the Tor Browser profile's cookies.sqlite file for session tokens.
   • CAnalyze the pagefile.sys file for remnants of the Tor Browser cache.
   • DSearch the memory dump for strings related to the marketplace domain or page content using a tool like bulk_extractor.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An investigator is constructing a timeline of a suspect's Tor Browser usage. They have found the following artifacts: the Tor Browser profile folder, the tor log file, and the Windows prefetch files. Which artifact is most useful for establishing the exact time the Tor Browser was first launched on the system?

   • AThe tor log file's first entry
   • BThe modification timestamp of the torrc file
   • CWindows prefetch files for Tor Browser executables
   • DThe creation timestamp of the profile folder
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which anti-forensic technique is employed by Tor Browser to prevent the recovery of deleted data?

   • AOverwriting memory and disk data with random data before deletion
   • BUsing a virtual machine to isolate all browser activity
   • CStoring all data in the cloud to avoid local traces
   • DFull disk encryption of the user's hard drive
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What type of information is typically found in the Tor Browser's browser console logs?

   • AJavaScript errors and warnings from web pages
   • BThe plaintext of all visited websites
   • CThe user's real IP address
   • DThe IP addresses of all Tor relays used in circuits
   Reveal Solution Discussion Select an answer first