Internet Artifacts Flashcards

An examiner analyzes a suspect's Edge (Chromium-based) browser profile. The 'Login Data' SQLite file contains password entries. What hashing/encryption method protects these stored passwords on Windows?

Answer: Windows DPAPI (Data Protection API) with AES-256 encryption

Chromium-based browsers on Windows use the Windows DPAPI to encrypt stored credentials, tying decryption to the user's Windows login credentials.

What forensic artifact can confirm that a suspect visited a website using a browser's 'Reader Mode' feature?

Answer: Browser history entries showing the reader-mode URL scheme (e.g., about:reader?url=)

Reader Mode URLs are stored in browser history with a distinctive scheme such as 'about:reader?url=' prepended to the original URL, confirming the feature was used.

During an EnCase examination, an analyst recovers a file with the extension '.partial' in the browser's download folder. What does this indicate?

Answer: A file download that was interrupted before completion

A .partial file is created by the browser as a temporary file for an in-progress download; its presence indicates an interrupted or incomplete download.

An examiner is investigating potential data exfiltration via a web-based file sharing service. Which combination of browser artifacts would BEST support this investigation?

Answer: Browser history showing upload URLs, cookies with session tokens, and cache containing confirmation pages

Combining history (URLs visited), cookies (session/account data), and cache (page content including upload confirmations) provides the strongest evidence of web-based exfiltration.

The 'Shortcuts' database in Google Chrome stores information about:

Answer: Previously typed text in the omnibox that led to navigation, used to improve autocomplete suggestions

Chrome's Shortcuts database records omnibox input text and the resulting navigation targets to power the address bar's autocomplete feature, revealing user typing patterns.

When an examiner uses EnCase to review a suspect's Skype for Web usage in a browser, which artifact type would capture message content that was loaded in the browser?

Answer: Browser cache files containing the cached web application data and message content

Web applications like Skype for Web store rendered content in the browser cache; examining cache files may reveal cached messages and conversation data.

A forensic examiner needs to determine the timezone setting of a browser to accurately interpret timestamp artifacts. Where is this configuration MOST reliably found?

Answer: The operating system's timezone setting, as browsers inherit the OS timezone for timestamp recording

Browsers use the host operating system's timezone setting to display and record local timestamps, so the OS timezone is authoritative for interpreting browser artifact times.