You are collecting browser artifacts from a suspect's computer. You have already imaged the hard drive. What is the most appropriate next step to preserve the browser artifacts for analysis?

Copy the browser profile to a USB drive and analyze it directly

Work from the forensic image, not the original drive

Run a live analysis tool on the original drive

Open the browser to verify the artifacts are present

You are reconstructing a timeline of a user's activities. The Chrome History database shows a visit to a webpage at 12:00:00. The Downloads database shows a file downloaded at 12:05:00. The Cookies database shows a cookie for the same domain was created at 12:06:00. However, the user's system clock was set 5 minutes ahead during this time. How does this affect your timeline?

The timestamps are unreliable and cannot be used

The cookie was created before the download

The timestamps are all shifted by 5 minutes, so the relative sequence remains the same

The download actually occurred before the visit

When collecting browser artifacts from a live system, what is the most important step to ensure the integrity of the evidence?

Rename the files to prevent accidental modification

Create a cryptographic hash of the files before and after collection

Copy the files to a network share

Open the browser to verify the files are accessible

An examiner is analyzing a Chrome profile and wants to extract the user's saved passwords. Which file should the examiner examine, and what additional information is needed?

The 'History' SQLite database, along with the user's browsing history

The 'Web Data' SQLite database, along with the user's Windows password

The 'Preferences' file, along with the user's Google account password

The 'Login Data' SQLite database, along with the encryption key from 'Local State'

You are analyzing a suspect's browsing activity. The Chrome History database shows a visit to a webpage at 14:32:15. The Downloads database shows a file downloaded from that same domain at 14:32:20. What can you most reasonably conclude?

The user likely visited the page and then initiated the download from that page

The user bookmarked the page after downloading

The user cleared their history after the download

The download occurred before the page visit

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 8)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 36–40

36application · medium
You are collecting browser artifacts from a suspect's computer. You have already imaged the hard drive. What is the most appropriate next step to preserve the browser artifacts for analysis?
Select an answer first
37expert · hard
You are reconstructing a timeline of a user's activities. The Chrome History database shows a visit to a webpage at 12:00:00. The Downloads database shows a file downloaded at 12:05:00. The Cookies database shows a cookie for the same domain was created at 12:06:00. However, the user's system clock was set 5 minutes ahead during this time. How does this affect your timeline?
Select an answer first
38foundation · easy
When collecting browser artifacts from a live system, what is the most important step to ensure the integrity of the evidence?
Select an answer first
39application · medium
An examiner is analyzing a Chrome profile and wants to extract the user's saved passwords. Which file should the examiner examine, and what additional information is needed?
Select an answer first
40application · medium
You are analyzing a suspect's browsing activity. The Chrome History database shows a visit to a webpage at 14:32:15. The Downloads database shows a file downloaded from that same domain at 14:32:20. What can you most reasonably conclude?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.