EnCE Internet Artifacts 2 — Questions and Answers
Question 1: In Internet Explorer, where are typed URLs stored that an examiner should recover during analysis?
- NTUSER.DAT registry hive under TypedURLs key (Correct answer)
- index.dat file in the Temporary Internet Files folder
- browser.db SQLite database
- cookies.txt in the AppData directory
Correct answer: NTUSER.DAT registry hive under TypedURLs key
IE stores URLs typed directly into the address bar in the NTUSER.DAT registry hive under the key Software\Microsoft\Internet Explorer\TypedURLs.
Question 2: Which EnCase feature is used to search for and recover deleted web browser history records from unallocated clusters?
- File Carving via EnScript (Correct answer)
- Hash Analysis
- Keyword Search on active files only
- Signature Analysis
Correct answer: File Carving via EnScript
EnCase's file carving capability, often implemented via EnScript, can recover deleted browser history records from unallocated disk space.
Question 3: A Firefox Places database contains a table called 'moz_historyvisits'. What does each row in this table primarily represent?
- A single visit event with timestamp and page reference (Correct answer)
- A stored password entry
- A bookmark folder
- A browser extension installation record
Correct answer: A single visit event with timestamp and page reference
Each row in moz_historyvisits records an individual visit event, linking to the URL in moz_places with an associated visit date and visit type.
Question 4: When examining Google Chrome's 'Top Sites' file, what format is it stored in?
- SQLite database (Correct answer)
- XML file
- Binary Registry hive
- JSON flat file
Correct answer: SQLite database
Chrome's Top Sites file is a SQLite database containing thumbnails and visit counts for the most frequently visited sites.
Question 5: An examiner finds a file named 'WebCacheV01.dat' on a Windows 10 system. Which browser's cache data does this file contain?
- Internet Explorer / Edge Legacy (Correct answer)
- Google Chrome
- Mozilla Firefox
- Opera
Correct answer: Internet Explorer / Edge Legacy
WebCacheV01.dat is an Extensible Storage Engine (ESE) database used by Internet Explorer and legacy Microsoft Edge to store cached web content and history.
Question 6: What is the significance of the 'last_visit_time' field found in Chrome's History SQLite database for forensic purposes?
- It records the most recent timestamp a URL was visited in WebKit epoch format (Correct answer)
- It records the total number of visits to a URL
- It stores the referrer URL for the page
- It indicates when the browser cache entry expires
Correct answer: It records the most recent timestamp a URL was visited in WebKit epoch format
The last_visit_time field stores the most recent visit timestamp in WebKit time (microseconds since January 1, 1601), which examiners must convert to human-readable time.
Question 7: During an investigation, an examiner needs to identify search terms a suspect entered on Google. In Chrome, where is this information most likely found?
- The 'keyword_search_terms' table in the History SQLite database (Correct answer)
- The 'cookies' SQLite database
- The Preferences JSON configuration file
- The 'Sync Data' LevelDB store
Correct answer: The 'keyword_search_terms' table in the History SQLite database
Chrome stores search queries submitted via the omnibox in the keyword_search_terms table within the History SQLite database, linked to the search engine used.
EnCE Internet Artifacts 2
In Internet Explorer, where are typed URLs stored that an examiner should recover during analysis?