What type of information is typically stored in a browser's form autofill data?

Names, addresses, and other personal information entered into web forms

The URLs of all websites visited

Usernames and passwords entered into login forms

The content of web pages viewed

What type of information is typically recorded in a browser's history database that is crucial for timeline analysis?

The exact content of web pages visited

The user's login credentials for each site

The IP address of the user's machine

The URL and the timestamp of each visit

A suspect deleted their Chrome history and cleared the cache using CCleaner. You need to recover evidence of a specific website visit. The system has been in use since the deletion. Which recovery method is most likely to yield results?

Check the browser's 'Last Session' file, which may contain the URL.

Carve the unallocated space of the hard drive for SQLite database pages and URL strings.

Use a file recovery tool to recover the deleted 'History' file from the Recycle Bin.

Restore the 'History' file from the Volume Shadow Copy.

An examiner is analyzing a user's browser data to determine what was entered into a web form. The browser's form autofill database is empty, but the user's browsing history shows visits to the form page. Which other artifact might contain the entered data?

The browser's cookie jar, which stores form submissions.

The browser's session restore file, which may contain the form state.

The browser's download history, which records form submissions.

The browser's cache, which may contain a copy of the submitted form data in the page's source.

GIAC Certified Forensic Examiner

Domain 3Objective 1

Browser Structure and Analysis GCFE Practice Questions (Page 9)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 41–45

41foundation · easy
What type of information is typically stored in a browser's form autofill data?
Select an answer first
42foundation · easy
What type of information is typically recorded in a browser's history database that is crucial for timeline analysis?
Select an answer first
43expert · hard
A suspect deleted their Chrome history and cleared the cache using CCleaner. You need to recover evidence of a specific website visit. The system has been in use since the deletion. Which recovery method is most likely to yield results?
Select an answer first
44expert · hard
An examiner is analyzing a user's browser data to determine what was entered into a web form. The browser's form autofill database is empty, but the user's browsing history shows visits to the form page. Which other artifact might contain the entered data?
Select an answer first
45foundation · easy
Which browser artifact is most likely to contain a record of a user's search terms entered into a search engine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.