GIAC
GCFE · Question #152
During a forensic investigation, you need to reconstruct a user's browsing history from Firefox. The user is suspected of accessing unauthorized sites, but they have cleared their history. Which…
The correct answer is A. Cache files B. Places.sqlite E. Form history. See the full explanation below for the reasoning.
Question
During a forensic investigation, you need to reconstruct a user's browsing history from Firefox. The user is suspected of accessing unauthorized sites, but they have cleared their history. Which artifacts would you examine to retrieve evidence of their browsing activities? (Choose three)
Options
- ACache files
- BPlaces.sqlite
- CPrefs.js
- DCookies.sqlite
- EForm history
How the community answered
(42 responses)- A86% (36)
- C5% (2)
- D10% (4)
Community Discussion
No community discussion yet for this question.