Welcome to the CHFI 312-49 Digital Forensics Simulator. This scenario will test your ability to identify overlay network artifacts and dark web browsing applications. Analyze the evidence and select the correct investigative conclusion.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are a digital forensics investigator assigned to a Los Angeles cyber task force. A suspect's laptop (Windows 11) was seized during a narcotics raid. Intelligence suggests the suspect was heavily involved in procuring illicit substances from a dark web marketplace.

Standard clearnet browsers (Chrome, Edge) on the suspect's machine show no history of illicit activity, only benign searches. The suspect claims they have never accessed the dark web. You must examine the system artifacts to determine how the suspect accessed the marketplace's hidden `.onion` addresses.

Evidence Collected

A dead-box physical image (E01) was created. Analysis of application execution artifacts yielded the following:

[EVIDENCE ITEM 01: File System Artifacts] Path: C:\Users\Admin\Desktop\Tor Browser\ Status: Directory heavily populated. Notable File: C:\Users\Admin\Desktop\Tor Browser\Browser\tor.exe [EVIDENCE ITEM 02: Prefetch Analysis] Target: C:\Windows\Prefetch\ Parsed Data: Executable: TOR.EXE-F5B3492A.pf Run Count: 47 Last Run Time: 2023-10-24 22:15:44 UTC (Matches time of suspected transaction) [EVIDENCE ITEM 03: Registry Analysis (UserAssist)] Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{...} Decoded Entry: UEME_RUNPATH:C:\Users\Admin\Desktop\Tor Browser\Start Tor Browser.lnk

Question

In a digital-forensics investigation in Los Angeles, an analyst is searching for evidence of a suspect's activity on a dark web marketplace. Which web browser is typically used to access the dark web (.onion sites)?

Investigator's Hint: Standard browsers use the standard DNS system to resolve domains (.com, .org). Hidden services ending in .onion do not exist in standard DNS; they require a specific browser bundled with an overlay network routing proxy to resolve and connect.

Expert Analysis

1. What the evidence shows

The forensic artifacts extracted from the disk image conclusively demonstrate the presence and frequent execution of an application designed for overlay networks. The Prefetch file (TOR.EXE) and UserAssist registry keys confirm that the suspect launched the Tor Browser precisely at the times coinciding with the illicit marketplace transactions.

2. Forensic Stage

Examination & Analysis: The investigator is analyzing application execution artifacts (Prefetch, UserAssist) to prove capability, intent, and timeline regarding the suspect's access to hidden services.

3. Why the correct answer is correct (Option A)

The Tor Browser is a modified version of Mozilla Firefox specifically engineered to route all its web traffic through the Tor (The Onion Router) network. It is the standard, primary tool required to resolve and access .onion pseudo-top-level domains, which host dark web marketplaces. Standard DNS cannot resolve these addresses.

4. Why the other options are wrong

  • B, C, and D are incorrect: Google Chrome, Mozilla Firefox, and Microsoft Edge are "clearnet" browsers out-of-the-box. While they can theoretically be configured to point to a Tor SOCKS proxy if the Tor daemon is running separately, they are not "typically used" out-of-the-box to access `.onion` sites. They lack the built-in onion routing protocols and the extensive privacy/anti-fingerprinting hardening of the Tor Browser.

5. Real-world forensic action

When dark web activity is suspected, investigators do not usually find a standard web history of `.onion` sites, as the Tor Browser operates in a permanent "Private Browsing" mode and doesn't write history to the disk. Instead, investigators pivot to looking for execution artifacts (Prefetch, Shimcache, Amcache, UserAssist), downloaded installers in the Downloads folder, and memory (RAM) strings if a live capture was performed.

MINI LESSON: Dark Web Forensics & Execution Artifacts

Because tools like the Tor Browser are designed to be anti-forensic regarding web history, investigators must rely on the operating system's application tracking mechanisms to prove usage:

  • Prefetch (.pf): Proves an application was executed, how many times, and the last run time. Crucial for timeline building.
  • UserAssist: Registry keys tracking GUI-based execution of shortcuts and executables.
  • LNK Files (Shortcuts): Track when a user interacted with a shortcut to launch the browser.

The absence of clearnet browser history is normal in these cases; finding the execution artifacts of the proxy browser is the smoking gun.

Explore more CHFI simulations