A forensic analyst is investigating a case involving the download of illegal software. The suspect used Microsoft Edge on a Windows 11 machine. Which artifact would provide the most reliable evidence of the downloaded files, including their source URLs and local save paths?

The 'History' SQLite database in the Edge profile, specifically the 'downloads' table.

The 'Cache' directory in the Edge profile.

The 'Cookies' SQLite database in the Edge profile.

An analyst is investigating a Mac system and needs to reconstruct a user's browsing activity. The analyst has access to the user's home directory. Which file should the analyst examine first to obtain the most complete list of visited URLs and visit timestamps?

~/Library/Safari/Downloads.plist

~/Library/Caches/com.apple.Safari/Cache.db

~/Library/Cookies/Cookies.binarycookies

During an investigation, an examiner finds that a suspect used Firefox's Private Browsing mode to access a website. The examiner wants to recover evidence of the accessed content. Which of the following is the most likely source of recoverable evidence?

The Firefox 'cookies.sqlite' database.

The Firefox profile's 'cache2' directory, which may contain cached content from the private session.

The Firefox 'places.sqlite' history database.

A suspect used Firefox in private browsing mode to view a sensitive document. The document was rendered in the browser. You have the forensic image. Which artifact is most likely to contain recoverable fragments of the document?

The Firefox places.sqlite history database

The Firefox formhistory.sqlite file

The Firefox cache folder under the profile directory

The Firefox cookies.sqlite file

EC-CouncilDigital Forensics Essentials

Domain 4Objective 3

Web Browser Forensics DFE Practice Questions (Page 5)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

42questions here

9free pages

8concepts

Questions 21–25

21application · medium
A forensic analyst is investigating a case involving the download of illegal software. The suspect used Microsoft Edge on a Windows 11 machine. Which artifact would provide the most reliable evidence of the downloaded files, including their source URLs and local save paths?
Select an answer first
22foundation · easy
In Firefox's places.sqlite database, which table stores the actual URL strings and visit timestamps for each browsing session?
Select an answer first
23application · medium
An analyst is investigating a Mac system and needs to reconstruct a user's browsing activity. The analyst has access to the user's home directory. Which file should the analyst examine first to obtain the most complete list of visited URLs and visit timestamps?
Select an answer first
24application · medium
During an investigation, an examiner finds that a suspect used Firefox's Private Browsing mode to access a website. The examiner wants to recover evidence of the accessed content. Which of the following is the most likely source of recoverable evidence?
Select an answer first
25application · medium
A suspect used Firefox in private browsing mode to view a sensitive document. The document was rendered in the browser. You have the forensic image. Which artifact is most likely to contain recoverable fragments of the document?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.