Web Browser Forensics DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are analyzing a forensic image from a macOS system. The user's default browser is Safari. You need to extract the browsing history to determine which websites were visited. Which approach is most appropriate?

   • AParse the SQLite database at ~/Library/Safari/History.db using a forensic tool that supports Safari.
   • BUse a Windows-based tool to directly read the History.db file without conversion.
   • CRead the plist file ~/Library/Preferences/com.apple.Safari.plist for visited URLs.
   • DCopy the entire ~/Library/Caches/com.apple.Safari folder and search for URLs in cache files.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An examiner is analyzing a Windows system. The user is suspected of downloading a file from a website. The examiner finds the file on the system, but the Chrome download history is empty. The user claims they used Chrome's Incognito mode. What is the most likely explanation?

   • AIncognito mode does not record downloads in the download history, but the file may still be in the Downloads folder
   • BThe user used a different browser to download the file
   • CThe file was not downloaded through a browser
   • DThe download history was manually deleted
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which browser artifact would a forensic examiner analyze to determine the exact files a user downloaded from the internet?

   • ABrowser history
   • BCookies
   • CCache files
   • DDownload records (e.g., Chrome's History 'downloads' table)
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a limitation of private browsing modes that forensic examiners can exploit?

   • APrivate browsing leaves traces in the Windows registry that record every URL visited
   • BPrivate browsing stores all history in an encrypted file that can be easily decrypted
   • CPrivate browsing does not encrypt network traffic, so packets can be captured
   • DPrivate browsing completely prevents any trace of internet activity from being stored
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An examiner is working on a case involving a macOS user who primarily uses Safari. The examiner needs to collect browser artifacts without altering the evidence. Which of the following is the most appropriate first step?

   • ARun a live analysis tool on the running system to view Safari history.
   • BCopy the ~/Library/Safari folder to an external drive using Finder.
   • CUse the 'safaridriver' command to export browsing data.
   • DCreate a forensic image of the entire disk using a write-blocker, then mount the image read-only and extract the Safari artifacts.
   Reveal Solution Discussion Select an answer first