Question

As an investigator, you are charged with creating a timeline of a user's Internet activity on a company computer. When going into the user's temporary Internet files, you see that the directory is empty. You know that the company has a policy restricting the person from seeing hidden directories on the system, so it is unlikely that they were able to delete them. How is it possible that this directory is empty?

A. The user is implementing a rootkit that bypasses system security and gives them access to the directory.
B. The user has configured Internet Explorer to delete the history every time she logs off.
C. The user has selected the box in Temporary Internet Files and History that says, "Every time I start Internet Explorer."
D. This isn't possible. IE always stores cached files permanently.

Answer 1

B. The user has configured Internet Explorer to delete the history every time she logs off.

Step-by-step explanation:

The user's temporary Internet files is empty because the user has configured Internet Explorer to delete the history every time she logs off.