Web Browser Forensics DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A suspect claims they used Chrome's Incognito mode to browse a website, and therefore no evidence exists. During analysis, you find that the website's content is partially present in the pagefile.sys. What does this indicate?

   • AIncognito mode does not prevent all data from being written to disk, such as memory paging
   • BThe website content was downloaded by another application, not the browser
   • CThe suspect is lying because Incognito mode never leaves any traces
   • DThe pagefile.sys is a red herring and cannot contain browser data
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a common file format used by Chrome to store cached web content on disk?

   • APlain text files with one URL per line
   • BA series of numbered files with a separate index file
   • CSQLite database files
   • DA single compressed archive file (e.g., .zip)
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During an investigation, an examiner finds that a suspect used Firefox on a Windows machine to view potentially incriminating images. The images are no longer in the browser's cache directory. Where might the examiner still find remnants of these images?

   • AIn the Firefox profile's 'cache2' subdirectory, possibly in unallocated space or as deleted files.
   • BIn the Firefox 'cookies.sqlite' file.
   • CIn the Firefox 'places.sqlite' file.
   • DIn the Windows 'Prefetch' folder.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary advantage of using a specialized browser forensics tool over manually parsing browser databases?

   • AIt automates the extraction and interpretation of artifacts, saving time and reducing errors
   • BIt guarantees the recovery of all deleted browser data
   • CIt can recover passwords from encrypted browser databases
   • DIt eliminates the need for a forensic image of the hard drive
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic examiner needs to collect browser artifacts from a Windows 10 workstation used by a suspect. The examiner must preserve the original timestamps of the artifacts and avoid altering file access times. Which approach best meets these requirements?

   • AOpen the browser and export the history to an HTML file for analysis.
   • BRun a live forensic tool on the running system to view the browser data in memory.
   • CCopy only the History and Cookies SQLite files to a USB drive without a write-blocker.
   • DUse a write-blocker and copy the entire user profile directory to an evidence drive, then parse the copied files with a forensic tool.
   Reveal Solution Discussion Select an answer first