EnCE Internet Artifacts 4 — Questions and Answers
Question 1: What is the forensic significance of the Windows DNS client cache ('ipconfig /displaydns') in an internet artifacts investigation?
- It reveals recently resolved domain names, indicating sites the system attempted to contact (Correct answer)
- It stores full HTTP response headers from visited sites
- It logs all HTTPS certificates encountered by the browser
- It contains the browser's entire browsing history
Correct answer: It reveals recently resolved domain names, indicating sites the system attempted to contact
The Windows DNS cache records recently resolved hostnames, providing evidence of domain names contacted by the system even if browser history has been cleared.
Question 2: In EnCase, an examiner wants to parse the Chrome 'Network Action Predictor' database. What forensic value does this artifact provide?
- It shows URLs Chrome preemptively fetched based on the user's typing patterns (Correct answer)
- It stores all blocked network connections by the firewall
- It logs all SSL/TLS handshake errors encountered
- It contains the complete list of installed browser extensions
Correct answer: It shows URLs Chrome preemptively fetched based on the user's typing patterns
The Network Action Predictor database records URL prefixes Chrome uses to pre-fetch pages as the user types, revealing partial URLs and browsing interests.
Question 3: A Windows Prefetch file named 'IEXPLORE.EXE-XXXXXXXX.pf' is found on a suspect's machine. What can an examiner determine from this artifact?
- That Internet Explorer was executed, along with the last eight run times and run count (Correct answer)
- The complete URL history of all sites visited in Internet Explorer
- All files downloaded using Internet Explorer
- The usernames that accessed Internet Explorer
Correct answer: That Internet Explorer was executed, along with the last eight run times and run count
Windows Prefetch files record executable run times (up to last 8) and run count, confirming that Internet Explorer was launched on the system.
Question 4: When examining browser cookies, the 'HttpOnly' flag is significant to a forensic examiner because it indicates:
- The cookie cannot be accessed by client-side JavaScript, suggesting it may store session tokens (Correct answer)
- The cookie was only transmitted over HTTP, not HTTPS
- The cookie was set by an HTTP proxy server
- The cookie was created during an anonymous browsing session
Correct answer: The cookie cannot be accessed by client-side JavaScript, suggesting it may store session tokens
The HttpOnly flag prevents JavaScript from reading the cookie, which is commonly used for session tokens to prevent XSS theft — relevant when assessing account hijacking scenarios.
Question 5: An examiner finds evidence of 'InPrivate' or 'Incognito' browsing. Which artifact would MOST likely still retain evidence of such sessions?
- Windows Event Logs and DNS cache, which persist outside the browser (Correct answer)
- The browser's History SQLite database
- Browser cookie files
- The browser's download history database
Correct answer: Windows Event Logs and DNS cache, which persist outside the browser
Private browsing modes prevent writing to browser history/cookies, but the Windows DNS cache and Event Logs operate at the OS level and can retain residual evidence.
Question 6: What is the purpose of the 'Cookies' artifact in browser forensics beyond proving a website was visited?
- Cookies can reveal user account names, session IDs, preferences, and timestamps of interactions with a site (Correct answer)
- Cookies store the full HTML content of visited pages
- Cookies contain encrypted user passwords for all sites
- Cookies log all file downloads initiated from a website
Correct answer: Cookies can reveal user account names, session IDs, preferences, and timestamps of interactions with a site
Cookies often contain username values, session identifiers, user preferences, and creation/expiry timestamps that provide detailed behavioral evidence beyond a simple site visit.
Question 7: In the context of EnCase and internet artifact analysis, what does the term 'carved' web history mean?
- Browser history records recovered from unallocated space after deletion (Correct answer)
- History entries imported from another browser
- History records that have been digitally signed for authentication
- Browser history exported to an external report
Correct answer: Browser history records recovered from unallocated space after deletion
Carved web history refers to browser history records recovered through file carving from unallocated disk space after the original database records were deleted.
EnCE Internet Artifacts 4
What is the forensic significance of the Windows DNS client cache ('ipconfig /displaydns') in an internet artifacts investigation?