An examiner is collecting browser artifacts from a live system and needs to preserve the integrity of the data. The examiner has a hardware write-blocker and a forensic imaging tool. Which step is essential to ensure the integrity of the collected artifacts?

Verify the hash of the acquired image against the original disk

Copy the browser profile folder separately before imaging

Use a software write-blocker on the destination drive

Close all browser applications before imaging

You are building a timeline of a user's activities. You have the following artifacts: Chrome History, Chrome Downloads, and Chrome Cookies. Which approach would give you the most comprehensive view of the user's browsing behavior?

Analyze only the Downloads database because it shows files the user intentionally saved

Analyze only the Cookies database because it shows all domains the user interacted with

Analyze only the History database because it contains all browsing activity

Correlate the timestamps from all three artifacts to create a unified timeline

During a forensic acquisition, an examiner needs to preserve browser artifacts from a live Windows system without altering them. Which approach best ensures the integrity of the browser profile data?

Create a forensic image of the entire hard drive using a hardware write-blocker, then extract the browser profile from the image

Copy the entire user profile directory to an external drive using standard Windows copy commands

Use Windows 'Copy-Item' in PowerShell to copy the profile to a network share

Perform a logical acquisition of the user's profile folder while the browser is closed, using a write-blocker on the destination

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 6)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 26–30

26expert · hard
An examiner is collecting browser artifacts from a live system and needs to preserve the integrity of the data. The examiner has a hardware write-blocker and a forensic imaging tool. Which step is essential to ensure the integrity of the collected artifacts?
Select an answer first
27application · medium
You are building a timeline of a user's activities. You have the following artifacts: Chrome History, Chrome Downloads, and Chrome Cookies. Which approach would give you the most comprehensive view of the user's browsing behavior?
Select an answer first
28application · medium
During a forensic acquisition, an examiner needs to preserve browser artifacts from a live Windows system without altering them. Which approach best ensures the integrity of the browser profile data?
Select an answer first
29foundation · easy
Which file in a Firefox profile directory stores the user's browsing history?
Select an answer first
30foundation · easy
To build a comprehensive picture of a user's online activity, an examiner should combine which two artifact types to show both the pages visited and the data entered into forms?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Browser Forensic Artifacts GCFE Practice Questions (Page 6)

Questions 26–30

An examiner is collecting browser artifacts from a live system and needs to preserve the integrity of the data. The examiner has a hardware write-blocker and a forensic imaging tool. Which step is essential to ensure the integrity of the collected artifacts?

You are building a timeline of a user's activities. You have the following artifacts: Chrome History, Chrome Downloads, and Chrome Cookies. Which approach would give you the most comprehensive view of the user's browsing behavior?

During a forensic acquisition, an examiner needs to preserve browser artifacts from a live Windows system without altering them. Which approach best ensures the integrity of the browser profile data?

Which file in a Firefox profile directory stores the user's browsing history?

To build a comprehensive picture of a user's online activity, an examiner should combine which two artifact types to show both the pages visited and the data entered into forms?

Keep studying — Browser Forensics