Chapter 18 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. Commit to an answer before you peek — guessing teaches nothing.

Multiple choice

Q1. You are collecting a Chrome History database for examination. To avoid analyzing a stale database that omits the most recent activity, you must also copy: - A) Only History - B) History and Bookmarks - C) History, History-wal, and History-shm, together - D) The entire Cache folder

Q2. To convert a Chromium last_visit_time value to a UTC date, you: - A) Divide by 1,000 and subtract 11,644,473,600 - B) Divide by 1,000,000, then subtract 11,644,473,600, and treat the result as Unix seconds - C) Add 978,307,200 - D) Divide by 1,000,000 (it is already a 1970-based epoch)

Q3. In a Chromium visits row, the low byte of the transition field (transition & 0xFF) equals 1. What did the user do? - A) Clicked a link - B) Typed the URL into the address bar (TYPED) - C) Loaded an automatic subframe such as an ad or embed - D) Reloaded the page

Q4. A cookie for mail.google.com has is_persistent = 0 and a last_access_utc of this morning. What does this best support? - A) The user visited google.com once, long ago - B) The user had an active, logged-in webmail session at that time - C) The account password is stored in the cookie in plaintext - D) Nothing about login state can be inferred

Q5. Which Firefox database combines browsing history and bookmarks, and on which epoch? - A) History.db, on Mac/Cocoa time - B) places.sqlite, on PRTime (microseconds since 1970) - C) WebCacheV01.dat, on FILETIME - D) cookies.sqlite, on Unix seconds

Q6. Safari's History.db records visit_time on which epoch? - A) Microseconds since 1601 (WebKit) - B) Microseconds since 1970 (PRTime) - C) Seconds since 2001-01-01 (Mac/Cocoa) - D) 100-nanosecond ticks since 1601 (FILETIME)

Q7. A suspect insists they "only used Incognito." Which source is least likely to help reconstruct that session? - A) The OS DNS resolver cache - B) SRUM (per-application bytes sent and received) - C) The persistent profile's History database - D) A RAM capture or the pagefile

Q8. A Chromium cookie's encrypted_value begins with the ASCII tag v10. Where is the AES key that protects it? - A) In the cookie file's own header - B) In Local State (os_crypt.encrypted_key), itself DPAPI-protected to the Windows user - C) In the SAM registry hive - D) Hard-coded into chrome.exe

Q9. On a corporate machine you suspect a personal Dropbox was linked. Which file most directly reveals the linked account email and the local sync-folder path? - A) filecache.dbx - B) config.dbx - C) info.json - D) host.dbx

Q10. Which statement about recovering cleared browser history from a SQLite database is correct? - A) A SQL DELETE immediately zeroes the row's bytes - B) Cleared rows persist in freelist pages and page slack until a VACUUM or page reuse overwrites them - C) Deleted rows can only ever be recovered from a full disk image, never from the database file - D) WAL files never contain history rows

True / False

Q11. Private/Incognito browsing leaves no recoverable trace of the session anywhere on the system. (True / False)

Q12. In Firefox's moz_cookies table, expiry is stored in microseconds, exactly like creationTime and lastAccessed. (True / False)

Short answer

Q13. In one or two sentences, give the two reasons you copy the db/-wal/-shm trio together and open it read-only when examining a browser SQLite database.

Q14. Name the three timestamp epochs you meet across Chrome, Firefox, and Safari (one browser for each), and give the formula to convert a Chrome/WebKit value to Unix seconds.

---

Answer key

Q1 — C. Modern Chromium runs SQLite in WAL mode; the most recent visits often live only in History-wal (with the History-shm index). Copy all three or you analyze a stale database and lose the latest activity.

Q2 — B. WebKit time is microseconds since 1601-01-01 UTC: divide by 1,000,000 for seconds-since-1601, then subtract 11,644,473,600 to reach Unix seconds. (A uses the wrong divisor; C is the Mac/Cocoa offset; D is the Firefox/PRTime rule.)

Q3 — B. Core transition 1 is TYPED — the user typed the URL into the address bar, the signature of intent. Core 0 is LINK, 3 is AUTO_SUBFRAME, 8 is RELOAD.

Q4 — B. A non-persistent (session) cookie with a recent last_access_utc for a webmail domain is evidence of an active logged-in session, not merely a visit. The value is encrypted, so C is false.

Q5 — B. places.sqlite holds both moz_places/moz_historyvisits (history) and moz_bookmarks, with times in PRTime (microseconds since 1970).

Q6 — C. Safari uses Mac/Cocoa absolute time — seconds since 2001-01-01 UTC; add 978,307,200 to reach Unix seconds.

Q7 — C. Incognito's one job is to keep the session out of the persistent profile databases, so History is exactly the source it defeats. DNS cache, SRUM, and RAM/pagefile all still capture the session.

Q8 — B. Since Chrome 80 the v10/v11 value is AES-256-GCM; the key sits in Local State under os_crypt.encrypted_key, base64-encoded and DPAPI-protected to the Windows user. Reading the plaintext is a Chapter 29 (encrypted-device) exercise.

Q9 — C. Modern Dropbox encrypts the .dbx files with SQLCipher, but info.json remains readable and reveals the linked account email and the local Dropbox-folder path — enough to prove a personal Dropbox on a corporate machine.

Q10 — B. DELETE frees the cell into the freelist without erasing bytes; the old content survives in freelist pages and page slack until a VACUUM rewrites the file or continued use reuses the pages. WAL files can and do hold history rows (A, C, D are false).

Q11 — False. Private mode only skips the persistent profile. DNS cache, RAM and pagefile/hiberfil, SRUM, favicons in some builds, and network/proxy logs routinely reconstruct the session.

Q12 — False. creationTime and lastAccessed are microseconds since 1970; expiry is plain Unix seconds. Applying the wrong divisor misdates a cookie by a factor of a million.

Q13. Because recent activity often lives only in the WAL (so you copy -wal/-shm to avoid a stale view), and because a default connection can checkpoint the WAL into the main file — altering both files and their hashes — so you open read-only (and set PRAGMA query_only) to keep the evidence byte-identical to what you imaged.

Q14. WebKit (Chrome/Edge/Chromium), PRTime (Firefox), and Mac/Cocoa absolute (Safari). WebKit → Unix seconds: unix = webkit_microseconds / 1,000,000 − 11,644,473,600.

Scoring: 13–14 — courtroom-ready; you can defend each artifact and convert any epoch without a cheat sheet. 10–12 — solid; revisit the epoch field guide and the transition table. 7–9 — re-read "SQLite: the database under (almost) every browser" and "Private/Incognito browsing," then redo Groups A, D, and E in the exercises. Below 7 — re-read the chapter index and rebuild the anchor-case upload timeline before moving on.