An examiner is reconstructing a timeline of a user's browsing activity. Which timestamp from the browser history is most appropriate for determining when a user first navigated to a specific webpage?

The visit_time in the visits table

The file system creation time of the History database

The last_visit_time in the urls table

The modification time of the cookies database

An examiner is collecting browser artifacts from a Windows system that is still running. The examiner wants to minimize changes to the artifacts. Which action should the examiner take first?

Create a full disk image using a hardware write-blocker

Shut down the system and then remove the hard drive for imaging

Copy the browser profile folder to an external drive using Windows Explorer

Run a forensic tool to parse the browser databases in place

An examiner is reconstructing a timeline from multiple browser artifacts and finds that the timestamps in the Chrome History database are in UTC, while the Firefox places.sqlite timestamps are in Unix epoch time. How should the examiner normalize these timestamps for a unified timeline?

Convert both to a common format, such as Unix epoch seconds, and then adjust for the user's timezone

Use the timestamps as they are, since they are both in UTC

Convert both to local time using the system's timezone settings

Convert the Chrome timestamps to Unix epoch time, but leave Firefox timestamps as they are

You are analyzing a Chrome History database that appears to have been partially corrupted. The urls table is intact, but the visits table has some missing rows. You also have the browser cache. How can you best reconstruct the missing visit timestamps?

Use the file system timestamps of the cached files to approximate visit times

Use the download times from the Downloads database

Use the last_visit_time from the urls table

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 2)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 6–10

6foundation · easy
An examiner is reconstructing a timeline of a user's browsing activity. Which timestamp from the browser history is most appropriate for determining when a user first navigated to a specific webpage?
Select an answer first
7application · medium
An examiner is collecting browser artifacts from a Windows system that is still running. The examiner wants to minimize changes to the artifacts. Which action should the examiner take first?
Select an answer first
8expert · hard
An examiner is reconstructing a timeline from multiple browser artifacts and finds that the timestamps in the Chrome History database are in UTC, while the Firefox places.sqlite timestamps are in Unix epoch time. How should the examiner normalize these timestamps for a unified timeline?
Select an answer first
9expert · hard
You are analyzing a Chrome History database that appears to have been partially corrupted. The urls table is intact, but the visits table has some missing rows. You also have the browser cache. How can you best reconstruct the missing visit timestamps?
Select an answer first
10foundation · easy
A forensic examiner is looking for evidence of a user's search terms entered into a search engine. Which browser artifact category is most likely to contain this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.