Certified Incident Handler (ECIH v3) — Question 51

Digital evidence plays a major role in prosecuting cyber criminals. John is a cyber-crime investigator, is asked to investigate a child pornography case. The personal computer of the criminal in question was confiscated by the county police. Which of the following evidence will lead John in his investigation?

Answer options

• A. SAM file
• B. Web serve log
• C. Routing table list
• D. Web browser history

Correct answer: D

Explanation

The correct answer is D, Web browser history, because it can provide direct evidence of the suspect's online activities and potentially link them to child pornography. The SAM file is related to user account management, the Web server log pertains to server activity, and the routing table list is concerned with network paths, none of which directly relate to the investigation of browsing activity.