Browser Structure and Analysis GCFE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary challenge when recovering deleted browser data from an SSD?

   • ASSDs use wear leveling and TRIM, which can permanently erase data blocks.
   • BSSDs store data in a proprietary format that is not readable by forensic tools.
   • CSSDs require a special power source to read deleted data.
   • DSSDs do not store deleted data at all.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic examiner needs to recover a specific image that a user viewed online. The image is no longer in the browser cache. Which technique is most likely to recover the image from the remaining cache files?

   • ACarve the image from the cache's index and data files using file-signature analysis.
   • BSearch the browser history for the image's URL and re-download it from the internet.
   • CLook in the browser's cookies for the image data.
   • DCheck the browser's form autofill database for the image.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An examiner is analyzing a user's browser data to determine what information was entered into a web form. Which artifact would contain this information?

   • AThe browser's cookie jar, which stores form submissions.
   • BThe browser's download history, which records form submissions.
   • CThe browser's cache, which stores the full content of submitted forms.
   • DThe browser's form autofill database, which stores previously entered form data.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An examiner is investigating a case involving unauthorized access to a web application. The examiner finds a session cookie in the user's browser that is still valid. What does this indicate?

   • AThe user visited the web application's login page but did not log in.
   • BThe user downloaded a file from the web application.
   • CThe user may have an active authenticated session with the web application.
   • DThe user cleared their browser history.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are examining a Firefox profile and need to find a list of files the user downloaded. Which file should you analyze?

   • AThe 'History' database in the Firefox profile folder.
   • BThe 'cookies.sqlite' database.
   • CThe 'formhistory.sqlite' database.
   • DThe 'downloads.sqlite' database in the Firefox profile folder.
   Reveal Solution Discussion Select an answer first