Exam 312-49v10 topic 1 question 611 discussion

D. Prefetch files --BUT-- Prefetch is DISABLED BY DEFAULT on SSD-based systems. Prefetch files exist as a function of the delays of spinning disks. The "most correct" answer shifts based on reality implied in the question. If you see "On a Windows 11 system" or "modern laptop" the implication is an SSD is present. Then between: (A) Swap file — On SSDs where Prefetch may be absent, swap files could contain residual evidence. (D) Prefetch — likely not present Choose A, because D loses viability under SSD assumptions. Always weigh technical accuracy + scenario realism. EVERY WORD MATTERS Questions often force best-available-answer decisions based on subtle context. Real-world forensics knowledge (like SSD presence and behavior) is implicitly tested. ----- If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

A. Swap files Swap files (or page files) can contain remnants of data from applications that were recently used, including Tor browser. Even if the Tor browser has been uninstalled, its artifacts might still be present in the swap files, which can provide evidence of its previous usage. Other options, such as security logs, files in the Recycle Bin, or prefetch files, might not provide as direct evidence of Tor browser activity as the swap files can.