Investigators conduct forensic analysis to examine Tor Browser activity. They scrutinize memory dumps to extract email artifacts and analyze storage devices for email attachments, both with the Tor…

Question

Options

• ATo analyze email attachments solely when the Tor Browser is closed
• BTo explore email artifacts and attachments with the Tor Browser in various states
• CTo examine email artifacts only when the Tor Browser is open
• DTo perform analysis post-uninstallation of the Tor Browser

• A
  9% (2)
• B
  83% (19)
• C
  4% (1)
• D
  4% (1)

Explanation

This question aligns directly with CHFI v11 objectives under Dark Web Forensics and Tor Browser Forensics. The Tor Browser is specifically designed to minimize persistent artifacts and anonymize user activity, which makes forensic investigations particularly challenging. CHFI v11 emphasizes that the primary objective in Tor Browser-related investigations is to identify and extract residual artifacts across multiple operational states of the browser. Investigators must analyze evidence when the Tor Browser is open, closed, and even after uninstallation, because artifacts may exist in different locations depending on the browser's state. Memory dumps can reveal live artifacts such as email content, session data, credentials, and attachments when the browser is running. Storage analysis can uncover downloaded email attachments, cached files, and remnants left behind after normal usage or uninstallation. CHFI v11 specifically highlights scenarios involving email forensics with Tor Browser open and closed, memory acquisition, and post-uninstallation analysis as complementary techniques rather than isolated tasks. Focusing on only one browser state would result in incomplete evidence collection. Therefore, the overarching forensic objective is to explore email artifacts and attachments across various Tor Browser states, making option B the correct and CHFI-aligned

No community discussion yet for this question.