EnCE Internet Artifacts 2

Question 1

In Internet Explorer, where are typed URLs stored that an examiner should recover during analysis?

Accepted Answer

NTUSER.DAT registry hive under TypedURLs key

Answer

IE stores URLs typed directly into the address bar in the NTUSER.DAT registry hive under the key Software\Microsoft\Internet Explorer\TypedURLs.

Question 2

Which EnCase feature is used to search for and recover deleted web browser history records from unallocated clusters?

Accepted Answer

File Carving via EnScript

Answer

EnCase's file carving capability, often implemented via EnScript, can recover deleted browser history records from unallocated disk space.

Question 3

A Firefox Places database contains a table called 'moz_historyvisits'. What does each row in this table primarily represent?

Accepted Answer

A single visit event with timestamp and page reference

Answer

Each row in moz_historyvisits records an individual visit event, linking to the URL in moz_places with an associated visit date and visit type.

Question 4

When examining Google Chrome's 'Top Sites' file, what format is it stored in?

Accepted Answer

SQLite database

Answer

Chrome's Top Sites file is a SQLite database containing thumbnails and visit counts for the most frequently visited sites.

Question 5

An examiner finds a file named 'WebCacheV01.dat' on a Windows 10 system. Which browser's cache data does this file contain?

Accepted Answer

Internet Explorer / Edge Legacy

Answer

WebCacheV01.dat is an Extensible Storage Engine (ESE) database used by Internet Explorer and legacy Microsoft Edge to store cached web content and history.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Internet Artifacts 2