A user has cleared their Chrome browsing data, including cache and cookies. The examiner needs to recover deleted browser data from the hard drive. Which method is most appropriate?

Perform file carving on unallocated space to recover remnants of SQLite databases and cache files.

Look in the Windows System Restore points for the browser data.

Use the browser's built-in restore feature to recover cleared data.

Check the Recycle Bin for the deleted browser files.

A user is suspected of visiting a website that is not in their browser history. Which artifact might still reveal the visit?

The browser's bookmarks, if the user bookmarked the site.

The browser's telemetry data, which records all URLs visited.

The browser's password manager, if the user saved a password for the site.

The browser's cache, which may contain files from the site even if history was cleared.

What is the primary forensic significance of a session cookie?

It contains the user's password in plaintext.

It indicates that the user was authenticated to a website during a specific browsing session.

It records the exact time the user closed the browser.

It stores the user's browsing history for that session.

An examiner is analyzing a Windows system with both Chrome and Edge installed. The user's Chrome history is empty, but Edge history shows significant activity. The examiner also finds that the user's Edge profile contains a 'History' file that is larger than expected. What is the most likely explanation?

The Edge history was created by Chrome's telemetry, so it is not user activity.

The Edge profile is corrupted, and the History file size is due to corruption.

The user used Edge for browsing, and the large History file may contain remnants of deleted entries.

The Edge history is a copy of Chrome's history, so the Chrome history is not actually empty.

Which browser, among the following, is based on the Chromium project and shares many forensic artifacts with Chrome?

Microsoft Edge (Chromium-based)

GIAC Certified Forensic Examiner

Domain 3Objective 1

Browser Structure and Analysis GCFE Practice Questions (Page 1)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 1–5

1application · medium
A user has cleared their Chrome browsing data, including cache and cookies. The examiner needs to recover deleted browser data from the hard drive. Which method is most appropriate?
Select an answer first
2application · medium
A user is suspected of visiting a website that is not in their browser history. Which artifact might still reveal the visit?
Select an answer first
3foundation · easy
What is the primary forensic significance of a session cookie?
Select an answer first
4expert · hard
An examiner is analyzing a Windows system with both Chrome and Edge installed. The user's Chrome history is empty, but Edge history shows significant activity. The examiner also finds that the user's Edge profile contains a 'History' file that is larger than expected. What is the most likely explanation?
Select an answer first
5foundation · easy
Which browser, among the following, is based on the Chromium project and shares many forensic artifacts with Chrome?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.