Computer Hacking Forensic Investigator (CHFI v10) — Question 557

A digital forensics investigator performs a browser history analysis after a suspected breach. The investigator deals with three web browsers: Mozilla Firefox, Coogle Chrome, and Microsoft Edge. The suspect was using Windows. The investigator must locate the cache, cookies, and history for all three browsers. What are the correct locations?

Answer options

• A. Firefox: Cache - C:\UsersWAppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cache2; Chrome: History - C:\Users\{user)\AppData\Local\Google\Crrome\User Data\Default; Edge: Cookies - C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxxxxxxx\AC\MicrosoftEdge\Cookies
• B. Firefox: Cookies - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\cookies.sqlite; Chrome: Cache - C:\Users\{user}\AppData\Local\Coogle\Chrome\User Data\Default\Cache; Edge: History - C:\Users\Admin\AppData\Local\Microsoft\Windows\History
• C. Firefox: Cache - C:\UsersWAppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\places.sqlite; Chrome: Cookies - C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default; Edge: History - C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
• D. Firefox: History - C:\Users\\AppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cookies.sqlite; Chrome: Cache - C:\Users\{user}\AppData\Local\Coogle\Chrome\User Data\Default\Cache; Edge: Cookies - C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxxxxxxx\AC\MicrosoftEdge\Cookies

Correct answer: B

Explanation

Option B is correct because it accurately lists the file paths for cookies, cache, and history for each browser on a Windows system. The other options contain incorrect paths or mix up the locations of cache, cookies, and history, which would not lead to retrieving the right information during a forensic investigation.