EnCE Internet Artifacts 3

Question 1

A forensic examiner is analyzing a suspect's system and finds '.lnk' files pointing to recently accessed websites saved locally. Which Windows feature creates these shortcut files?

Accepted Answer

Windows Shell automatically creates LNK files for recently accessed items

Answer

Windows Shell automatically creates .lnk (shortcut) files in the Recent Items folder for files and objects recently accessed, which can include locally saved web pages.

Question 2

What does the 'Referrer' field in a browser history record indicate to a digital forensic examiner?

Accepted Answer

The URL of the page that linked to the visited page

Answer

The Referrer field stores the URL from which the user navigated to the current page, helping examiners reconstruct the browsing path.

Question 3

In the context of web browser forensics, what is a 'favicon.ico' file and why is it significant?

Accepted Answer

A small site icon cached by browsers that can prove a site was visited even if history was cleared

Answer

Favicons are small icons cached separately from general browser history; their presence in the favicon cache can prove a site was visited even after history deletion.

Question 4

An examiner uses EnCase to examine a Windows system and needs to find evidence of email accessed via a web-based client. Which artifact location is MOST relevant?

Accepted Answer

Browser cache and cookies directories for the webmail domain

Answer

Webmail is accessed through the browser, so evidence resides in browser cache, cookies, and history files associated with the webmail provider's domain.

Question 5

Firefox's 'sessionstore.jsonlz4' file is forensically significant because it contains:

Accepted Answer

Tabs and windows open during the last browser session, including URLs and scroll positions

Answer

sessionstore.jsonlz4 preserves the state of the last browser session including open tabs, URLs, and form data, which may capture activity not yet written to history.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Internet Artifacts 3