EC-CouncilDigital Forensics Essentials
Domain 6Objective 2
Tor Browser Forensics DFE Practice Questions (Page 7)
Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.
47questions here
10free pages
10concepts
Questions 31–35
- 31
A forensic analyst is examining a macOS system where the user downloaded Tor Browser and moved it to the Applications folder. The analyst needs to find the Tor Browser profile data to look for browsing artifacts. Which path is the default location for Tor Browser profile data on macOS?
Select an answer first - 32
A forensic examiner has a memory dump from a system where Tor Browser was running. The examiner wants to recover encryption keys that could be used to decrypt Tor traffic captured on the network. Which type of key is most likely to be found in the memory dump?
Select an answer first - 33
A forensic examiner is trying to recover evidence from a computer where the user ran Tor Browser and then forcefully terminated the process (e.g., via Task Manager) before shutting down the system. The examiner has a full disk image and a memory dump taken just after the forced termination. Which combination of techniques is most likely to recover useful evidence?
Select an answer first - 34
A forensic examiner is investigating a suspect who used Tor Browser and then attempted to cover their tracks by deleting the Tor Browser folder and running a disk-wiping tool. The examiner has a full disk image taken after the deletion but before the wiping tool was run. Which technique is most likely to recover evidence?
Select an answer first - 35
A forensic examiner is investigating a Tor Browser installation on a macOS system. The user claims they only used the browser in 'Private Browsing' mode and that no data was saved. Which artifact would the examiner most likely find to contradict this claim?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.