Web Browser Forensics DFE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An examiner is investigating a case where a user allegedly accessed a website during a specific time window. The user claims they were using Chrome's Incognito mode. The examiner finds that the Chrome History database has no entries for that time window, but the pagefile.sys contains fragments of the website's content. What is the most reasonable conclusion?

   • AThe website content in the pagefile is coincidental and unrelated to the user's activity
   • BThe user used a different browser that does not store history
   • CThe user may have used Incognito mode, but the website content was paged to disk from memory
   • DThe user did not use Incognito mode because the content is in the pagefile
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic examiner is investigating a case where a suspect used Firefox on a Linux system to download a file. The examiner has the disk image and needs to prove the download occurred and identify the source URL. The 'places.sqlite' database has been deleted by the suspect. What is the most effective alternative approach?

   • ASearch the unallocated space for remnants of the 'places.sqlite' database or its WAL files.
   • BLook at the Linux '~/.bash_history' for wget or curl commands.
   • CExamine the 'cookies.sqlite' database for the source URL.
   • DCheck the 'cache2' directory for the downloaded file.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When a user browses in Chrome's Incognito mode, which of the following artifacts is typically NOT written to disk?

   • APrefetch files
   • BNetwork packets
   • CDNS cache entries
   • DBrowsing history
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What type of information is typically stored in a browser cookie that is relevant to forensic analysis?

   • AThe complete source code of every webpage visited
   • BThe user's full browsing history including all visited URLs
   • CSession identifiers, user preferences, and tracking tokens
   • DThe user's saved passwords in plaintext
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What type of data can be recovered from browser form autofill records?

   • AUser-entered information such as names, addresses, and search terms
   • BThe user's IP address at the time of each visit
   • CThe complete content of every webpage visited
   • DThe user's saved passwords in plaintext
   Reveal Solution Discussion Select an answer first