GCFA · Question #19
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online
The correct answer is A. History folder B. Temporary Internet Folder D. Cookies folder. Investigating webmail accessed through a browser requires examining browser-generated artifacts cached locally on the machine, including history, temporary files, and cookies.
Question
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
Options
- AHistory folder
- BTemporary Internet Folder
- CDownload folder
- DCookies folder
How the community answered
(26 responses)- A77% (20)
- C23% (6)
Why each option
Investigating webmail accessed through a browser requires examining browser-generated artifacts cached locally on the machine, including history, temporary files, and cookies.
The browser History folder records URLs and timestamps for all visited pages, including webmail login and message URLs, providing direct evidence of online email access.
The Temporary Internet Files folder stores cached copies of rendered webmail pages and previewed content, which can contain email body text and headers retrieved during the session.
The Downloads folder only contains files the user explicitly saved to disk and does not capture browser session artifacts or webmail content from online email activity.
The Cookies folder holds session and authentication tokens set by webmail providers such as Hotmail or Yahoo, which can confirm account access and session timing even when page content is no longer cached.
Concept tested: Browser artifact forensics for online webmail investigation
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
Topics
Community Discussion
No community discussion yet for this question.