Web Browser Forensics DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During an investigation, you find a cookie file from a banking website. You need to determine whether the user was authenticated at the time of the cookie's creation. Which piece of information from the cookie would be most useful?

   • AThe cookie's domain attribute
   • BThe cookie's 'HttpOnly' flag
   • CThe cookie's expiration date
   • DThe cookie's value, especially if it contains a session identifier or authentication token
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An examiner is analyzing a suspect's Chrome profile on a Windows system. The examiner wants to determine which websites the user was logged into and for how long the session cookies were valid. Which artifact(s) should the examiner examine?

   • AThe 'History' SQLite database only.
   • BThe 'Cache' directory only.
   • CThe 'Cookies' SQLite database and the 'Login Data' SQLite database in the Chrome profile.
   • DThe 'Preferences' file only.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An examiner is analyzing a macOS system. The user used Safari to stream a video. The examiner needs to prove that the video was watched. The examiner finds that the Safari cache contains video segments, but the history database has no entry for the video URL. What is the most likely explanation?

   • AThe history database is corrupted
   • BThe video was accessed through a different browser
   • CThe user deleted the history entry manually
   • DThe user may have used Private Browsing mode, which prevents history but not cache
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   Your forensic lab receives a case involving a Linux system with multiple browsers installed (Firefox, Chrome, and Chromium). You need to quickly collect and analyze browser artifacts from all three browsers. Which approach is most efficient?

   • AUse a specialized browser forensics tool that supports multiple browsers and automates collection and analysis
   • BOnly analyze Firefox because it is the default browser on most Linux systems
   • CManually locate and parse each browser's SQLite databases using command-line tools
   • DCopy the entire home directory and search for files containing 'history' or 'cookies'
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the context of browser forensics, what does a session cookie indicate when found on a suspect's computer?

   • AThe user visited the website exactly once and never returned
   • BThe user cleared their browsing history
   • CThe user's browser was infected with malware
   • DThe user was logged into a website at the time the cookie was created
   Reveal Solution Discussion Select an answer first