Dark Web Forensics ECSS Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   An investigator has identified a dark web site that is streaming illegal content. The investigator wants to capture the stream as evidence. The site is only accessible via Tor. What is the most forensically sound method to acquire this evidence?

   • ADownload the streaming file directly to the investigation machine and save it as evidence.
   • BTake photographs of the screen with a mobile phone to avoid digital artifacts.
   • CUse a screen capture tool on a dedicated investigation machine while accessing the site via Tor, and document the entire process.
   • DRecord the stream using a third-party screen recorder and store the file on a cloud service.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A forensic examiner is analyzing a suspect's computer and finds a file named 'torrc' in the Tor Browser directory. What does this file contain that could be useful to the investigation?

   • AThe user's Tor Browser bookmarks.
   • BThe user's Bitcoin wallet private keys.
   • CConfiguration settings for the Tor client, such as proxy settings and relay preferences.
   • DA list of all .onion sites visited by the user.
   Reveal Solution Discussion Select an answer first