nerdexam
GIAC

GPEN · Question #111

You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online

The correct answer is A. History folder B. Temporary Internet Folder C. Cookies folder. Forensic investigation of webmail activity requires examining browser artifacts - history, cached files, and cookies - because the email content never resides in a local mail client.

Penetration Testing Foundations & Reconnaissance

Question

You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AHistory folder
  • BTemporary Internet Folder
  • CCookies folder
  • DDownload folder

How the community answered

(22 responses)
  • A
    82% (18)
  • D
    18% (4)

Why each option

Forensic investigation of webmail activity requires examining browser artifacts - history, cached files, and cookies - because the email content never resides in a local mail client.

AHistory folderCorrect

The browser History folder records URLs visited, which can confirm access to webmail portals and reveal specific message IDs or actions taken within the email interface.

BTemporary Internet FolderCorrect

The Temporary Internet Files folder caches rendered HTML content from visited pages, which can include the actual body of emails that were opened and read in the browser.

CCookies folderCorrect

The Cookies folder stores session tokens and authentication cookies that can prove a user authenticated to a specific webmail account and when that session occurred.

DDownload folder

The Download folder only contains files the user explicitly chose to save to disk and does not capture webmail session activity, viewed email content, or authentication events.

Concept tested: Webmail forensic artifact locations in browser cache

Source: https://www.sciencedirect.com/science/article/pii/S1742287609000243

Topics

#email forensics#browser artifacts#temporary internet files#digital investigation

Community Discussion

No community discussion yet for this question.

Full GPEN Practice