Browser Structure and Analysis GCFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are investigating a Windows system with multiple user accounts. Each user has their own Chrome profile. Where would you find the Chrome profile for a specific user?

   • AUnder 'C:\Windows\System32\config\systemprofile\AppData'.
   • BUnder 'C:\Users\Public\Google\Chrome\User Data'.
   • CUnder 'C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default'.
   • DUnder 'C:\Program Files\Google\Chrome\Application\User Data'.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which browser component is responsible for managing the local storage of cookies, cache, and other persistent data, and why is it a key focus in forensic examinations?

   • AStorage manager; it coordinates the filesystem and database backends that persist cookies, cache, and other data.
   • BJavaScript engine; it executes scripts that may write to localStorage, but it does not manage the overall storage.
   • CUser interface layer; it renders toolbars and menus, which can store user preferences.
   • DNetworking stack; it manages the HTTP cache and cookies as part of connection handling.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are examining a Windows 10 system used by two employees who share the same user account. You find two Chrome profile directories under the user's 'AppData\Local\Google\Chrome\User Data'. One is named 'Default' and the other 'Profile 1'. What is the most likely explanation for the existence of two profiles?

   • AThe system has two different versions of Chrome installed, each using its own profile directory.
   • BOne employee created a separate Chrome profile to isolate their browsing data from the other employee.
   • COne profile is a leftover from a previous Windows user account that was migrated.
   • DThe 'Profile 1' directory was created automatically by a browser extension.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A suspect's Chrome history shows a visit to a social media site at 14:32:15, but the system's $MFT shows the 'History' database file was last modified at 14:32:20. The user claims they were not at the computer at that time. Which analysis step is most important to verify the reliability of the history timestamp?

   • AVerify that the 'History' database is not corrupted by running a SQLite integrity check.
   • BCompare the history timestamp with the browser's cache file timestamps for the same site.
   • CCheck whether the system clock was synchronized with a time server and whether any clock changes occurred around that time.
   • DCheck the user's Windows Event Logs for logon/logoff events to confirm they were away.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   In a corporate investigation, you find a Firefox profile with cookies for a webmail service. The cookies include a session ID that is still valid. The user denies accessing the webmail. Which additional artifact would most strongly support that the user actively logged in from this machine?

   • AA recent modification timestamp on the 'cookies.sqlite' file.
   • BA corresponding entry in the Firefox 'places.sqlite' history database for the webmail login page.
   • CThe presence of the cookie file in the profile directory.
   • DThe user's saved password in the Firefox 'logins.json' file.
   Reveal Solution Discussion Select an answer first