Exam 312-49v10 topic 1 question 827 discussion

QUESTION STATES: "The suspect was known to clear their browser history frequently." THUS: Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History would likely be empty THEREFORE: The only remaining option to recover any of the required data would be to check the cache Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache - If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

D. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache Explanation: To recover browser history from a Microsoft Edge browser on a Windows system, the Browsing HistoryView tool can be used effectively. The path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache is where Microsoft Edge stores its browsing history, making it the correct choice for recovering this information. MZCacheView and MZHistoryView are tools for Mozilla Firefox cache and history, not Microsoft Edge. The path provided for Browsing HistoryView in option D points to the location where Microsoft Edge’s browsing history is stored.

has to be in History since Webcache is always stored in Roaming

Edge History Location: C:\Users\Admin\AppData\Local\Microsoft\Windows\History

BrowsingHistoryView reads history data and displays the browsing history in one table It allows users to view the browsing history of all user profiles in a running system. Edge History Location: C:\Users\Admin\AppData\Local\Microsoft\Windows\History