EnCE Internet Artifacts 3 — Questions and Answers
Question 1: A forensic examiner is analyzing a suspect's system and finds '.lnk' files pointing to recently accessed websites saved locally. Which Windows feature creates these shortcut files?
- Windows Shell automatically creates LNK files for recently accessed items (Correct answer)
- Internet Explorer's Favorites manager
- Windows Firewall logging
- The Windows Update service
Correct answer: Windows Shell automatically creates LNK files for recently accessed items
Windows Shell automatically creates .lnk (shortcut) files in the Recent Items folder for files and objects recently accessed, which can include locally saved web pages.
Question 2: What does the 'Referrer' field in a browser history record indicate to a digital forensic examiner?
- The URL of the page that linked to the visited page (Correct answer)
- The IP address of the web server
- The browser version used during the visit
- The username logged in at the time of the visit
Correct answer: The URL of the page that linked to the visited page
The Referrer field stores the URL from which the user navigated to the current page, helping examiners reconstruct the browsing path.
Question 3: In the context of web browser forensics, what is a 'favicon.ico' file and why is it significant?
- A small site icon cached by browsers that can prove a site was visited even if history was cleared (Correct answer)
- A browser configuration file storing user preferences
- An encrypted password storage file
- A temporary file created during file downloads
Correct answer: A small site icon cached by browsers that can prove a site was visited even if history was cleared
Favicons are small icons cached separately from general browser history; their presence in the favicon cache can prove a site was visited even after history deletion.
Question 4: An examiner uses EnCase to examine a Windows system and needs to find evidence of email accessed via a web-based client. Which artifact location is MOST relevant?
- Browser cache and cookies directories for the webmail domain (Correct answer)
- Windows Mail application data folder
- Microsoft Outlook PST files
- Exchange Server transaction logs
Correct answer: Browser cache and cookies directories for the webmail domain
Webmail is accessed through the browser, so evidence resides in browser cache, cookies, and history files associated with the webmail provider's domain.
Question 5: Firefox's 'sessionstore.jsonlz4' file is forensically significant because it contains:
- Tabs and windows open during the last browser session, including URLs and scroll positions (Correct answer)
- All stored login credentials for visited sites
- The complete download history of the browser
- Browser extension configuration and permissions
Correct answer: Tabs and windows open during the last browser session, including URLs and scroll positions
sessionstore.jsonlz4 preserves the state of the last browser session including open tabs, URLs, and form data, which may capture activity not yet written to history.
Question 6: When examining Flash Local Shared Objects (LSOs), also called Flash cookies, where are they typically stored on a Windows system?
- \AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ (Correct answer)
- \AppData\Local\Temp\Flash\
- \Windows\System32\drivers\Flash\
- \Program Files\Adobe\Flash Player\cache\
Correct answer: \AppData\Roaming\Macromedia\Flash Player\#SharedObjects\
Flash LSOs are stored in the user's AppData\Roaming\Macromedia\Flash Player\#SharedObjects directory, organized by domain name.
Question 7: An examiner suspects a user uploaded files via a web browser. Which browser artifact would MOST likely contain evidence of file upload activity?
- Browser history entries with POST method indicators and form data in cache (Correct answer)
- Browser bookmark files
- The browser's certificate store
- DNS cache entries on the OS
Correct answer: Browser history entries with POST method indicators and form data in cache
File uploads generate POST requests; browser history may retain the URL and some cached page data, while form data remnants can appear in browser cache entries.
EnCE Internet Artifacts 3
A forensic examiner is analyzing a suspect's system and finds '.lnk' files pointing to recently accessed websites saved locally.
Which Windows feature creates these shortcut files?