An examiner is reconstructing a timeline of a user's browsing activity. The examiner has access to the Chrome History database and the user's local timezone settings. Which timestamp should the examiner use to accurately reflect the user's local time for the timeline?

The 'last_visit_time' column in the 'urls' table, converting from local time to UTC

The 'last_modified' column in the 'favicons' table, which is in Unix epoch seconds

The 'time' column in the 'downloads' table, which is already in local time

The 'visit_time' column in the 'visits' table, converting from UTC to local time

An examiner is analyzing a Windows 10 system with multiple user profiles. The examiner needs to determine which user profile contains artifacts from a specific browser. Which approach is most efficient?

Search each user's profile directory for the browser's specific database files (e.g., History, places.sqlite)

Examine the Windows Registry for browser usage per user

Check the system's installed programs list to see which browser is installed

Look at the 'Recent' folder in each user profile

You are investigating a case where the user is suspected of downloading illegal content. The Chrome History shows a visit to a website, but the Downloads database is empty. However, you find a file on the system that matches the name of a file available on that website. What is the most likely explanation?

The user bookmarked the file and then downloaded it later

The user downloaded the file using a different browser or method

The file was already on the system before the visit

The user cleared the Downloads database

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 1)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 1–5

1foundation · easy
In Chrome's 'History' SQLite database, which table contains the actual URLs visited by the user?
Select an answer first
2application · medium
An examiner is reconstructing a timeline of a user's browsing activity. The examiner has access to the Chrome History database and the user's local timezone settings. Which timestamp should the examiner use to accurately reflect the user's local time for the timeline?
Select an answer first
3expert · hard
An examiner is analyzing a Windows 10 system with multiple user profiles. The examiner needs to determine which user profile contains artifacts from a specific browser. Which approach is most efficient?
Select an answer first
4foundation · easy
An examiner finds a URL in the browser history that points to a file download. To confirm that the file was actually downloaded, which other artifact should be correlated with the history entry?
Select an answer first
5expert · hard
You are investigating a case where the user is suspected of downloading illegal content. The Chrome History shows a visit to a website, but the Downloads database is empty. However, you find a file on the system that matches the name of a file available on that website. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Browser Forensic Artifacts GCFE Practice Questions (Page 1)

Questions 1–5

In Chrome's 'History' SQLite database, which table contains the actual URLs visited by the user?

An examiner is reconstructing a timeline of a user's browsing activity. The examiner has access to the Chrome History database and the user's local timezone settings. Which timestamp should the examiner use to accurately reflect the user's local time for the timeline?

An examiner is analyzing a Windows 10 system with multiple user profiles. The examiner needs to determine which user profile contains artifacts from a specific browser. Which approach is most efficient?

An examiner finds a URL in the browser history that points to a file download. To confirm that the file was actually downloaded, which other artifact should be correlated with the history entry?

Keep studying — Browser Forensics