312-49V11 · Question #170
A CHFI has been asked to recover browser history from a seized Microsoft Edge browser on a Windows system. This is important to pinpoint the suspect's online activities. The suspect was known to…
The correct answer is D. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache. Microsoft Edge/IE artifacts and related browsing records are commonly stored under the Windows WebCache (ESE database). BrowsingHistoryView can parse these artifacts from the WebCache location, making D the most direct and efficient option for Edge history recovery.
Question
A CHFI has been asked to recover browser history from a seized Microsoft Edge browser on a Windows system. This is important to pinpoint the suspect's online activities. The suspect was known to clear their browser history frequently. Which tool and path would most efficiently recover the required data?
Options
- AMZCacheView tool; Path:
- BMZHistoryView tool; Path:
- CBrowsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History
- DBrowsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
How the community answered
(46 responses)- A4% (2)
- B17% (8)
- C9% (4)
- D70% (32)
Explanation
Microsoft Edge/IE artifacts and related browsing records are commonly stored under the Windows WebCache (ESE database). BrowsingHistoryView can parse these artifacts from the WebCache location, making D the most direct and efficient option for Edge history recovery.
Topics
Community Discussion
No community discussion yet for this question.