GPEN · Question #111
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online
The correct answer is A. History folder B. Temporary Internet Folder C. Cookies folder. Forensic investigation of webmail activity requires examining browser artifacts - history, cached files, and cookies - because the email content never resides in a local mail client.
Question
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
Options
- AHistory folder
- BTemporary Internet Folder
- CCookies folder
- DDownload folder
How the community answered
(22 responses)- A82% (18)
- D18% (4)
Why each option
Forensic investigation of webmail activity requires examining browser artifacts - history, cached files, and cookies - because the email content never resides in a local mail client.
The browser History folder records URLs visited, which can confirm access to webmail portals and reveal specific message IDs or actions taken within the email interface.
The Temporary Internet Files folder caches rendered HTML content from visited pages, which can include the actual body of emails that were opened and read in the browser.
The Cookies folder stores session tokens and authentication cookies that can prove a user authenticated to a specific webmail account and when that session occurred.
The Download folder only contains files the user explicitly chose to save to disk and does not capture webmail session activity, viewed email content, or authentication events.
Concept tested: Webmail forensic artifact locations in browser cache
Source: https://www.sciencedirect.com/science/article/pii/S1742287609000243
Topics
Community Discussion
No community discussion yet for this question.