Web Browser Forensics DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are examining a Firefox profile on a Windows system. You need to recover search terms the user entered into a search engine. Which file should you analyze?

   • Aplaces.sqlite
   • Bformhistory.sqlite
   • Cprefs.js
   • Dcookies.sqlite
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A user is suspected of downloading a confidential document from a company portal using Firefox on a Linux machine. The examiner needs to prove the download occurred and identify the source URL. Which artifact should be examined?

   • AThe 'cache2' directory.
   • BThe 'cookies.sqlite' database.
   • CThe 'places.sqlite' database in the Firefox profile, specifically the 'moz_downloads' table.
   • DThe Linux '~/.local/share/recently-used.xbel' file.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A user is suspected of logging into a webmail service. You find a session cookie in the browser's cookie database. What does the presence of a session cookie indicate?

   • AThe user's password was stored in the browser
   • BThe user used private browsing mode
   • CThe user is currently logged in
   • DThe user had an active authenticated session at some point
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An examiner is working on a case involving a Linux system with Firefox, Chrome, and Chromium installed. The examiner needs to produce a comprehensive report of all browser artifacts. The examiner has limited time and budget. Which approach is most appropriate?

   • AOnly analyze Firefox because it is the most common browser on Linux
   • BManually parse each browser's databases using command-line tools
   • CPurchase an expensive commercial tool that supports all browsers
   • DUse an open-source browser forensics tool that supports multiple browsers and can be scripted
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A suspect claims they used Chrome's Incognito mode exclusively for all browsing on a Windows 10 system. However, the forensic examiner finds that the 'History' database contains URLs that match the suspect's testimony about their activities. What is the most likely explanation?

   • AThe examiner is mistaken; the History database cannot contain incognito browsing data.
   • BChrome's Incognito mode actually writes to the History database but hides it from the user interface.
   • CThe suspect used a third-party tool to inject false history entries.
   • DThe suspect used Incognito mode but also had a regular Chrome window open, and the history was written from the regular window.
   Reveal Solution Discussion Select an answer first