The forensic investigation of android private browsing sessions using orweb

Abstract

The continued increase in the usage of Small Scale Digital Devices (SSDDs) to browse the web has made mobile devices a rich potential for digital evidence. Issues may arise when suspects attempt to hide their browsing habits using applications like Orweb -which intends to anonymize network traffic as well as ensure that no browsing history is saved on the device. In this work, the researchers conducted experiments to examine if digital evidence could be reconstructed when the Orweb browser is used as a tool to hide web browsing activates on an Android smartphone. Examinations were performed on both a non-rooted and a rooted Samsung Galaxy S2 smartphone running Android 2.3.3. The results show that without rooting the device, no private web browsing traces through Orweb were found. However, after rooting the device, the researchers were able to locate Orweb browser history, and important corroborative digital evidence was found.

Conceptual evidence collection and analysis methodology for Android devices

“…A number of authors (Maus et al, 2011;Al Mutawa et al, 2012;Kim et al, 2012;Barghouthy et al, 2013;Andriotis et al, 2012;Sylve et al, 2012;Lessard and Kessler, 2010) use tools developed by third parties that are generally not designed for forensic collection purposes and, as such, may result in the integrity of the evidence collected being questioned as part of legal processes (e.g., changes to the user data partition without the forensic practitioner's knowledge). This is most commonly part of the 'rooting' process or flashing a third-party (unverified) "recovery OS."…”

Exploring the protection of private browsing in desktop browsers

“…The results showed that both versions revealed the same amount of artefacts, thereby concluding that the portable version of the browser does not offer enhanced security guarantees regarding the user's privacy. Moreover, Al Barghouthy et al (2013) evaluated the available solutions that offer privacy protection to users. More specifically, they evaluated the Orweb browser that anonymizes network traffic and avoids saving the browsing history.…”

Social Networks IM Forensics: Encryption Analysis

“…It is designed to protect your anonymity over the internet and can encrypt your communications multiple times across the Internet [2]. According to [11], a research paper proposed a method to investigate a web browsing session artifacts left on Android mobile devices. It discussed the Tor browsing features and the proper method to acquire the digital smart device in order to retrieve all possible artifacts after browsing session.…”

“…User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates [13]. According to [11], a research paper performed a network forensics on an encrypted communication channel and examined the artifacts left by Skype on the communication traffic.…”