Browser Forensic Artifacts GCFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   In a forensic investigation, you find a suspicious URL in the Chrome history. You also find a corresponding entry in the Cookies database for the same domain. What does the presence of a cookie for that domain most strongly indicate?

   • AThe user bookmarked the page
   • BThe user interacted with the site beyond just loading the page
   • CThe user downloaded a file from that site
   • DThe user cleared their browsing history
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An examiner is analyzing a Firefox profile and finds that the 'places.sqlite' database is corrupted. Which other artifact could provide a partial list of the user's browsing history?

   • AThe 'cookies.sqlite' database, which stores cookies with the domains visited
   • BThe 'formhistory.sqlite' database, which stores form inputs and search terms
   • CThe 'prefs.js' file, which stores user preferences and some browsing data
   • DThe 'sessionstore.jsonlz4' file, which contains the last session's open tabs and history
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are preparing to acquire forensic images of a suspect's browser artifacts from a live Windows system. The suspect's browser is currently running. What is the most appropriate first step to preserve the integrity of the browser artifacts?

   • ADisable write access to the entire disk before copying
   • BCopy the entire user profile directory while the browser is running
   • CTerminate the browser process before acquiring the files
   • DUse a tool to read the files directly from the running process's memory
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   In a forensic investigation, you need to determine if a user visited a specific website even though the browsing history has been cleared. Which artifact might still contain evidence of the visit?

   • ABookmarks
   • BForm history
   • CCookies
   • DBrowser cache
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You are reconstructing a timeline of a suspect's web activity. You have the Chrome History database and the Downloads database. Which combination of timestamps from these artifacts would provide the most reliable evidence that a user visited a page and then downloaded a file from that page?

   • AThe last_visit_time from the urls table and the end_time from the downloads table
   • BThe visit_duration from the visits table and the target_path from the downloads table
   • CThe visit_time from the visits table and the start_time from the downloads table
   • DThe first_visit_time from the urls table and the received_bytes from the downloads table
   Reveal Solution Discussion Select an answer first