EnCE Internet Artifacts 4

Question 1

What is the forensic significance of the Windows DNS client cache ('ipconfig /displaydns') in an internet artifacts investigation?

Accepted Answer

It reveals recently resolved domain names, indicating sites the system attempted to contact

Answer

The Windows DNS cache records recently resolved hostnames, providing evidence of domain names contacted by the system even if browser history has been cleared.

Question 2

In EnCase, an examiner wants to parse the Chrome 'Network Action Predictor' database. What forensic value does this artifact provide?

Accepted Answer

It shows URLs Chrome preemptively fetched based on the user's typing patterns

Answer

The Network Action Predictor database records URL prefixes Chrome uses to pre-fetch pages as the user types, revealing partial URLs and browsing interests.

Question 3

A Windows Prefetch file named 'IEXPLORE.EXE-XXXXXXXX.pf' is found on a suspect's machine. What can an examiner determine from this artifact?

Accepted Answer

That Internet Explorer was executed, along with the last eight run times and run count

Answer

Windows Prefetch files record executable run times (up to last 8) and run count, confirming that Internet Explorer was launched on the system.

Question 4

When examining browser cookies, the 'HttpOnly' flag is significant to a forensic examiner because it indicates:

Accepted Answer

The cookie cannot be accessed by client-side JavaScript, suggesting it may store session tokens

Answer

The HttpOnly flag prevents JavaScript from reading the cookie, which is commonly used for session tokens to prevent XSS theft — relevant when assessing account hijacking scenarios.

Question 5

An examiner finds evidence of 'InPrivate' or 'Incognito' browsing. Which artifact would MOST likely still retain evidence of such sessions?

Accepted Answer

Windows Event Logs and DNS cache, which persist outside the browser

Answer

Private browsing modes prevent writing to browser history/cookies, but the Windows DNS cache and Event Logs operate at the OS level and can retain residual evidence.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Internet Artifacts 4