GIAC
GCFE · Question #155
You are conducting a forensic investigation on a Mozilla Firefox installation. The user has attempted to conceal their browsing activity by clearing the history. What browser files could still…
The correct answer is A. Places.sqlite B. Formhistory.sqlite C. Cache files. See the full explanation below for the reasoning.
Question
You are conducting a forensic investigation on a Mozilla Firefox installation. The user has attempted to conceal their browsing activity by clearing the history. What browser files could still contain useful forensic data for reconstructing browsing habits? (Choose three)
Options
- APlaces.sqlite
- BFormhistory.sqlite
- CCache files
- DSystem.log
- ECookies.sqlite
How the community answered
(24 responses)- A71% (17)
- D8% (2)
- E21% (5)
Community Discussion
No community discussion yet for this question.