An examiner is analyzing a Linux system and finds that the user used both Firefox and Chromium. The examiner needs to locate the browser history for both browsers. Which set of paths is correct?

Firefox: ~/.firefox/history.db; Chromium: ~/.chromium/history

Firefox: ~/.local/share/firefox/places.sqlite; Chromium: ~/.config/chromium/Default/History

Firefox: ~/.config/firefox/history.sqlite; Chromium: ~/.mozilla/chromium/History

Firefox: ~/.mozilla/firefox/ /places.sqlite; Chromium: ~/.config/chromium/Default/History

A forensic examiner is analyzing a Windows 10 system. The user has both Internet Explorer 11 and Microsoft Edge (Chromium) installed. The examiner needs to determine which websites were visited using each browser. The examiner has access to the WebCacheV01.dat file and the Edge History database. Which approach is most appropriate?

Only analyze the Edge History database because IE11 is obsolete

Use the WebCacheV01.dat for both browsers because Edge uses the same database

Analyze the Edge History database and assume all activity is from Edge

Parse WebCacheV01.dat for IE11 history and the Edge History database for Edge history, then correlate timestamps

Why is it important for a forensic examiner to know the exact version of a web browser when analyzing its artifacts?

Because the browser version is required to decrypt the hard drive

Because the browser version determines the operating system it runs on

Because different versions may use different database schemas or file formats for storing artifacts

Because older browsers do not store any forensic artifacts

A suspect used Firefox's Private Browsing mode to visit a website. You have the forensic image. Which artifact is LEAST likely to contain evidence of the visit?

The Firefox places.sqlite history database

The Firefox sessionstore backup files

Your team is investigating a case involving a macOS system with Safari and Chrome installed. You need to produce a report of all browser artifacts. Which tool would be most appropriate?

A commercial forensic suite that supports both Safari and Chrome on macOS

A Linux-based tool that only supports Firefox

A tool that only parses Chrome history

Manual extraction using command-line tools

EC-CouncilDigital Forensics Essentials

Domain 4Objective 3

Web Browser Forensics DFE Practice Questions (Page 4)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

42questions here

9free pages

8concepts

Questions 16–20

16application · medium
An examiner is analyzing a Linux system and finds that the user used both Firefox and Chromium. The examiner needs to locate the browser history for both browsers. Which set of paths is correct?
Select an answer first
17expert · hard
A forensic examiner is analyzing a Windows 10 system. The user has both Internet Explorer 11 and Microsoft Edge (Chromium) installed. The examiner needs to determine which websites were visited using each browser. The examiner has access to the WebCacheV01.dat file and the Edge History database. Which approach is most appropriate?
Select an answer first
18foundation · easy
Why is it important for a forensic examiner to know the exact version of a web browser when analyzing its artifacts?
Select an answer first
19application · medium
A suspect used Firefox's Private Browsing mode to visit a website. You have the forensic image. Which artifact is LEAST likely to contain evidence of the visit?
Select an answer first
20application · medium
Your team is investigating a case involving a macOS system with Safari and Chrome installed. You need to produce a report of all browser artifacts. Which tool would be most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.