Do Private and Portable Web Browsers Leave Incriminating Evidence? A Forensic Analysis of Residual Artifacts from Private and Portable Web Browsing Sessions

Abstract

The Internet is an essential tool for everyday tasks. Aside from common usage, users desire the option to browse the Internet in a private manner. This can create a problem when private Internet sessions become hidden from computer investigators in need of evidence. Our primary focus in this research is to discover residual artifacts from private and portable browsing sessions. In addition, the artifacts must contain more than just file fragments and enough to establish an affirmative link between user and session. Certain aspects of this topic have triggered many questions, but there have not been enough authoritative answers to follow. As a result, we propose a new methodology for analyzing private and portable web browsing artifacts. Furthermore, our research will serve to be a significant resource for law enforcement, computer forensic investigators, and the digital forensics research community.

A process-level analysis of private browsing behavior: A focus on Google Chromes Incognito mode

“…Yet the Incognito function maintained its privacy as browsing metadata relating to the browsing session could not be recovered. These results are consistent with existing research, where physical memory is indicated to offer a greater chance of discovering browsing actions carried out in a private environment [13][15].…”

“…Results differ, yet commonly physical memory and associated disk structures (Hiberfil.sys and Pagefile.sys) are highlighted as key areas for analysis [13] [15], with variable degrees of success regarding the identification of evidential metadata found on the local disk drive [14]. Whilst most research focusing on testing the privacy functionality of a browsing application involves demonstrating whether browsing metadata can be subsequently found on a system, postbrowsing session, this article centers on examining the behavior of the private browsing applications process.…”

Private browsing: A window of forensic opportunity

“…They find weaknesses in all but do not report the possibility of data retention in Internet Explorer 8. In contrast Ohana and Shashidhar (2013), also working with Internet Explorer 8 and other browsers identified recoverable evidence in unallocated and slack space. Similar results were obtained by Said et al (2011) who noted evidence on disk and in physical memory for InPrivate browsing in Internet Explorer 8.…”

Forensic Reconstruction and Analysis of Residual Artifacts from Portable Web Browser

“…In addition, other researchers suggest that the major web browsers were not created equally in regard to the type and quantity of data that they leave behind on the host machine [5]. These researchers examined the various internet browsers in order to determine what traces of browsing activity were retained in the physical memory after using the private browsing modes of each browser.…”

“…This implies that the browser is not an integral part of the computer and can be launched from the portable drive on any supported host and platform [5]. When using a portable web browsers the assumption is that user privacy is enhanced because the browsing data is cached in the portable storage device rather than the host persistent storage [1].…”