You are collecting browser artifacts from a suspect's computer. The suspect's browser is running, and you have a write-blocker available. You also have a forensic imaging tool. What is the most defensible approach to preserve the browser artifacts?

Use a live forensic tool to read the browser's memory and then acquire the disk

Copy the browser profile directory to an external drive without a write-blocker

Terminate the browser process, then use the write-blocker to acquire the disk

Use the write-blocker and acquire the entire disk, then analyze the image

An examiner is reconstructing a timeline from Chrome artifacts and notices that the 'visit_time' in the History database is inconsistent with the 'last_visit_time' in the URL table for the same URL. What is the most likely explanation?

The system clock was changed between visits, causing the timestamps to diverge

The URL was visited multiple times, and the 'last_visit_time' reflects the most recent visit, while 'visit_time' reflects the first visit

The 'visit_time' is from a different browser profile

The 'visit_time' is in UTC and 'last_visit_time' is in local time, causing an apparent inconsistency

You are investigating a macOS system where the user uses Safari. Where is the Safari browsing history stored?

~/Library/Application Support/Safari/History.plist

~/Library/Preferences/com.apple.Safari.plist

~/Library/Caches/Safari/History.db

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 4)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 16–20

16foundation · easy
What is the primary file format used by modern browsers like Chrome and Firefox to store history, cookies, and other browsing data?
Select an answer first
17expert · hard
You are collecting browser artifacts from a suspect's computer. The suspect's browser is running, and you have a write-blocker available. You also have a forensic imaging tool. What is the most defensible approach to preserve the browser artifacts?
Select an answer first
18expert · hard
An examiner is reconstructing a timeline from Chrome artifacts and notices that the 'visit_time' in the History database is inconsistent with the 'last_visit_time' in the URL table for the same URL. What is the most likely explanation?
Select an answer first
19application · medium
You are investigating a macOS system where the user uses Safari. Where is the Safari browsing history stored?
Select an answer first
20application · medium
You are examining Firefox browser artifacts on a Linux system. You need to find the user's browsing history. Where is the history stored in the Firefox profile directory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Browser Forensic Artifacts GCFE Practice Questions (Page 4)

Questions 16–20

What is the primary file format used by modern browsers like Chrome and Firefox to store history, cookies, and other browsing data?

You are collecting browser artifacts from a suspect's computer. The suspect's browser is running, and you have a write-blocker available. You also have a forensic imaging tool. What is the most defensible approach to preserve the browser artifacts?

An examiner is reconstructing a timeline from Chrome artifacts and notices that the 'visit_time' in the History database is inconsistent with the 'last_visit_time' in the URL table for the same URL. What is the most likely explanation?

You are investigating a macOS system where the user uses Safari. Where is the Safari browsing history stored?

You are examining Firefox browser artifacts on a Linux system. You need to find the user's browsing history. Where is the history stored in the Firefox profile directory?

Keep studying — Browser Forensics