A Forensic Examination of Online Search Facility URL Record Structures

Horsman, Graeme

doi:10.1111/1556-4029.13818

Cited by 4 publications

(1 citation statement)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Horsman provides recent technical notes on various searching functions of several popular browsers, however, only two of Bing's FORM parameters are described (RESTAB and QSRE) [16].…”

Section: Existing Researchmentioning

confidence: 99%

Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine

Spear¹,

Hawbecker²,

Mcelyea³

2022

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

During a 2016 criminal investigation overseen by the authors, a discovery was made that the Bing search engine was suggesting search terms known to be associated with child exploitation materials. This was in response to a non-contraband search by a subject, leading to increasingly explicit suggestions. This information led to the discovery that, with a user's browser history files, the specific actions taken by a user could be isolated and tracked using Bing's own unique URL parameters. While the suggestion of contraband terms by the Bing search engine has since ceased, there has been little to no research conducted on analyzing a user's browser activity in order to determine their specific actions behind the keyboard through the use of these unique URL parameters. The purpose of this paper is to document Bing's URL parameters related to image searches (specifically the FORM parameter) in order to detail how a user's actions during searching may be determined by an analyst. The authors also provide a new tool for creating a timeline of Bing image search events when an analyst possesses a user's browser history files.Disclaimer: Some portions of this article discuss words or language that are considered profane, vulgar, or offensive. This article is neither a legal interpretation nor a statement of [agency redacted during review] policy. Reference to any specific product or entity does not constitute an endorsement or recommendation by the [agency redacted during review]. Views and opinions expressed by the authors are those of the authors and do not necessarily reflect the view of the [agency redacted during review] or any of its officials.

show abstract

“…Horsman provides recent technical notes on various searching functions of several popular browsers, however, only two of Bing's FORM parameters are described (RESTAB and QSRE) [16].…”

Section: Existing Researchmentioning

confidence: 99%