Computer Hacking Forensic Investigator (CHFI v10) — Question 435

A CHFI has been asked to recover browser history from a seized Microsoft Edge browser on a Windows system. This is important to pinpoint the suspect's online activities. The suspect was known to clear their browser history frequently. Which tool and path would most efficiently recover the required data?

Answer options

• A. MZCacheView tool; Path: C:\UsersWAppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cache2
• B. MZHistoryView tool; Path: C:\UsersWAppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\places.sqlite
• C. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History
• D. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache

Correct answer: D

Explanation

The correct answer is D because the Browsing HistoryView tool can effectively access the WebCache folder, which retains browsing data even after the history has been cleared. Options A and B reference Firefox, which is not relevant to recovering Microsoft Edge data, while option C does not point to the location where Edge’s comprehensive browsing data is stored.