What is the primary purpose of a web browser's cache folder in the context of digital forensics?

To record the exact time of every keystroke made by the user

To permanently archive all downloaded files for the user's reference

To temporarily store web resources (e.g., images, scripts, HTML) to speed up page loading

To store user passwords in plaintext for quick login

A forensic analyst is examining a Windows 10 system and needs to determine the exact time a user visited a specific webpage. The user used Internet Explorer (IE) before upgrading to Edge. Which artifact would provide the most reliable timestamp for the visit?

The Windows 'Recent' folder shortcuts.

IE's History file (index.dat) and Edge's History database.

The browser's cookies, which contain session times.

The browser's cache files, which contain the last accessed time.

A user is suspected of downloading a confidential file from a cloud storage service using Google Chrome on Windows. You need to recover evidence of the download. Which artifact would provide the most reliable record of the download's source URL and local file path?

Chrome's History database (History file) in the User Data folder

An examiner is investigating a case where a suspect used Firefox's Private Browsing mode to view illegal content. The examiner has the full disk image. Which of the following is the most effective approach to recover evidence of the viewed content?

Check the Windows 'Prefetch' files for Firefox.

Examine the Firefox 'places.sqlite' database for history entries.

Search the unallocated space of the disk for file signatures of images and web page fragments.

Look for cookies in the 'cookies.sqlite' database.

EC-CouncilDigital Forensics Essentials

Domain 4Objective 3

Web Browser Forensics DFE Practice Questions (Page 1)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

42questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which of the following is a specialized tool designed to parse and analyze browser history, cache, and cookies from multiple browsers?
Select an answer first
2foundation · easy
What is the primary purpose of a web browser's cache folder in the context of digital forensics?
Select an answer first
3application · medium
A forensic analyst is examining a Windows 10 system and needs to determine the exact time a user visited a specific webpage. The user used Internet Explorer (IE) before upgrading to Edge. Which artifact would provide the most reliable timestamp for the visit?
Select an answer first
4application · medium
A user is suspected of downloading a confidential file from a cloud storage service using Google Chrome on Windows. You need to recover evidence of the download. Which artifact would provide the most reliable record of the download's source URL and local file path?
Select an answer first
5expert · hard
An examiner is investigating a case where a suspect used Firefox's Private Browsing mode to view illegal content. The examiner has the full disk image. Which of the following is the most effective approach to recover evidence of the viewed content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.