Malware & Dark Web

Scenario 2: Visiting Malicious Websites or Engaging in Cybercrime

An individual is suspected of accessing dark web sites for illegal transactions.

Forensic Questions to Frame

• Which browsers or apps were used to access the web (Chrome, Firefox, Tor)?
• What URLs were accessed, and what was their content?
• Were VPNs or proxy apps used to mask location?
• Are there downloaded files or cached web content stored on the device?
• When was the suspicious content accessed?
• Is there evidence of cryptocurrency apps or wallets?

Where to Find These Questions?

To find the answers to these questions, we will extract and examine the following evidence:

• Browser history and web activity
• Web cache and downloads
• Use of anonymous or privacy-focused browsers
• Communication apps linked to web-based crime