EnCE Internet Artifacts 5 — Questions and Answers
Question 1: An examiner analyzes a suspect's Edge (Chromium-based) browser profile. The 'Login Data' SQLite file contains password entries. What hashing/encryption method protects these stored passwords on Windows?
- Windows DPAPI (Data Protection API) with AES-256 encryption (Correct answer)
- MD5 hashing with a static salt
- SHA-256 hashing with the username as salt
- RSA public key encryption using a browser-generated certificate
Correct answer: Windows DPAPI (Data Protection API) with AES-256 encryption
Chromium-based browsers on Windows use the Windows DPAPI to encrypt stored credentials, tying decryption to the user's Windows login credentials.
Question 2: What forensic artifact can confirm that a suspect visited a website using a browser's 'Reader Mode' feature?
- Browser history entries showing the reader-mode URL scheme (e.g., about:reader?url=) (Correct answer)
- A separate reader-mode database file
- Windows Prefetch files with a 'READER' prefix
- A dedicated reader-mode registry key
Correct answer: Browser history entries showing the reader-mode URL scheme (e.g., about:reader?url=)
Reader Mode URLs are stored in browser history with a distinctive scheme such as 'about:reader?url=' prepended to the original URL, confirming the feature was used.
Question 3: During an EnCase examination, an analyst recovers a file with the extension '.partial' in the browser's download folder. What does this indicate?
- A file download that was interrupted before completion (Correct answer)
- A browser extension that failed to install
- A corrupted browser cache entry
- A file quarantined by antivirus during download
Correct answer: A file download that was interrupted before completion
A .partial file is created by the browser as a temporary file for an in-progress download; its presence indicates an interrupted or incomplete download.
Question 4: An examiner is investigating potential data exfiltration via a web-based file sharing service. Which combination of browser artifacts would BEST support this investigation?
- Browser history showing upload URLs, cookies with session tokens, and cache containing confirmation pages (Correct answer)
- Only the browser download history database
- Windows Event Logs and browser bookmarks
- Browser extension files and the browser's crash reports
Correct answer: Browser history showing upload URLs, cookies with session tokens, and cache containing confirmation pages
Combining history (URLs visited), cookies (session/account data), and cache (page content including upload confirmations) provides the strongest evidence of web-based exfiltration.
Question 5: The 'Shortcuts' database in Google Chrome stores information about:
- Previously typed text in the omnibox that led to navigation, used to improve autocomplete suggestions (Correct answer)
- Keyboard shortcuts configured by the user
- Bookmarked URLs with associated keyboard shortcut keys
- Browser history entries that were manually pinned by the user
Correct answer: Previously typed text in the omnibox that led to navigation, used to improve autocomplete suggestions
Chrome's Shortcuts database records omnibox input text and the resulting navigation targets to power the address bar's autocomplete feature, revealing user typing patterns.
Question 6: When an examiner uses EnCase to review a suspect's Skype for Web usage in a browser, which artifact type would capture message content that was loaded in the browser?
- Browser cache files containing the cached web application data and message content (Correct answer)
- Windows Registry Run keys
- NTFS alternate data streams on the browser executable
- The browser's certificate trust store
Correct answer: Browser cache files containing the cached web application data and message content
Web applications like Skype for Web store rendered content in the browser cache; examining cache files may reveal cached messages and conversation data.
Question 7: A forensic examiner needs to determine the timezone setting of a browser to accurately interpret timestamp artifacts. Where is this configuration MOST reliably found?
- The operating system's timezone setting, as browsers inherit the OS timezone for timestamp recording (Correct answer)
- A dedicated browser timezone configuration file
- The browser's user preferences JSON file under a 'timezone' key
- Browser cookies set by visited websites
Correct answer: The operating system's timezone setting, as browsers inherit the OS timezone for timestamp recording
Browsers use the host operating system's timezone setting to display and record local timestamps, so the OS timezone is authoritative for interpreting browser artifact times.
EnCE Internet Artifacts 5
An examiner analyzes a suspect's Edge (Chromium-based) browser profile.
The 'Login Data' SQLite file contains password entries.
What hashing/encryption method protects these stored passwords on Windows?