What is the aim of internet forensics?

• A. To decrypt all private web traffic
• B. To determine whether a user’s internet activity was illegal
• C. To piece together where and when a user has been on the internet, and whether inappropriate access or downloading was accidental
• D. To block all access to social media sites

Answer: (C)

Internet forensics aims to reconstruct a user’s online footprint—where they went on the web and when—to understand what happened and in what context. This involves analyzing artifacts such as browser history, downloads, cookies, DNS and IP logs, system and application logs, and network captures across devices. By aligning timestamps and sources, investigators build a timeline that shows how access or downloads occurred and whether actions were intentional or accidental. It’s not about decrypting all private web traffic, which isn’t always possible or permissible, nor about making judgments of legality. Nor is it about blocking access to sites; it’s about collecting and interpreting evidence to explain online activity.