Tor Browser Forensics DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic examiner is analyzing a Tor Browser profile from a suspect's computer. The examiner wants to find evidence of a specific search query the user entered into a search engine. Which file or database is most likely to contain this information?

   • Acookies.sqlite
   • Bprefs.js
   • Cplaces.sqlite
   • Dformhistory.sqlite
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   How does Tor Browser isolate traffic for different websites to prevent tracking?

   • ABy blocking all JavaScript and other active content
   • BBy assigning each website a unique circuit and isolating cookies and other site data
   • CBy encrypting all traffic with a single circuit that never changes
   • DBy using a separate browser profile for each website visited
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   How does the NoScript extension in Tor Browser affect data persistence?

   • AIt blocks JavaScript and other active content, reducing the amount of data that can be stored or tracked.
   • BIt encrypts all persistent data to protect it from forensic analysis.
   • CIt forces the browser to use a new profile for each session, preventing any persistence.
   • DIt prevents all cookies from being stored, making all data non-persistent.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a forensic artifact that can be found in the Tor Browser profile directory?

   • Antuser.dat
   • Bplaces.sqlite
   • CSAM
   • Dindex.dat
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a potential identifier that could link Tor Browser activity to a specific user?

   • AThe user's real IP address
   • BThe user's browser history stored in places.sqlite
   • CThe user's computer name
   • DThe user's MAC address
   Reveal Solution Discussion Select an answer first