Private Browsing Forensics - Computer and Digital Forensics
Private Browsing Forensics - Computer and Digital Forensics
Private Browsing Forensics - Computer and Digital Forensics
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Private</strong> <strong>Browsing</strong> <strong>Forensics</strong>Team Lead Trevin MoweryTeam Members: Kyle Tellers, David Thomas, & Christina EspritThe Senator Patrick Leahy Center for <strong>Digital</strong> InvestigationOctober 22 nd , 2012
Patrick Leahy Center for <strong>Digital</strong> Investigation (LCDI)Disclaimer:This document contains information based on research that has been gathered by employee(s) of The SenatorPatrick Leahy Center for <strong>Digital</strong> Investigation (LCDI). The data contained in this project is submittedvoluntarily <strong>and</strong> is unaudited. Every effort has been made by LCDI to assure the accuracy <strong>and</strong> reliability of thedata contained in this report. However, LCDI nor any of our employees make no representation, warranty orguarantee in connection with this report <strong>and</strong> hereby expressly disclaims any liability or responsibility for lossor damage resulting from use of this data. Information in this report can be downloaded <strong>and</strong> redistributed byany person or persons. Any redistribution must maintain the LCDI logo <strong>and</strong> any references from this reportmust be properly annotated.ContentsContents.....................................................................................................................................................................11 Introduction ........................................................................................................................................................2Version: 0.1 – Document Name: – Review Date: MM/DD/YYYY Page 1 of 4
Patrick Leahy Center for <strong>Digital</strong> Investigation (LCDI)1 IntroductionMany people use the internet every day. Unfortunately, not everyone uses it legally. Some individuals usethe internet for nefarious activities, <strong>and</strong> they need a way to effectively hide what they did on the internet or away to stop all information from being written to the hard drive to avoid leaving evidence. Google Chrome,Mozilla Firefox, <strong>and</strong> Internet Explorer all have something built in called “<strong>Private</strong> <strong>Browsing</strong>” that are believedto do just that. We want to conduct research to see if these “<strong>Private</strong> Browsers” can actually hide all traces ofinternet history <strong>and</strong> to see what is left behind or recoverable, if anything at all.1.1 Purpose <strong>and</strong> AudienceWe are conducting this research to provide an in depth explanation of where Internet Explorer, MozillaFirefox, <strong>and</strong> Google Chrome store artifacts left behind when a user is utilizing “private” mode. We wouldlike this information to be available to forensic examiners that may encounter this during their research orwork.1.2 Research QuestionsIn our research, we will attempt to answer the following questions:See how each private browser is different – Do they leave/hide the same types of data?Try to recover cacheTry to recover cookiesTry to recover any historyIs there anything on the system indicating that a private browser was used?Is it possible to see what was downloaded?What type of internet data is hidden or not left behind? What can’t be recovered?What can be recovered?If we can, try to find where this data is stored if not on the hard drive – Memory?1.3 ContributionsBy the end of our project we hope to provide a reference for examiners to use that will explain how toexamine web history when private browsing techniques were used.1.4 Prior WorkSome prior work that has been done on this topic (which we have referenced) can be found here:http://www.tdfcon.org.uk/papers/SD.pdfhttp://crypto.stanford.edu/~dabo/pubs/papers/privatebrowsing.pdfhttp://www.howtogeek.com/117776/htg-explains-how-private-browsing-works-<strong>and</strong>-why-it-doesnt-offercomplete-privacy/http://info.pittsburgh.intel-research.net/people/gibbons/papers/fc97.pdfhttp://www.symantec.com/connect/articles/web-browser-forensics-part-1http://www.symantec.com/connect/articles/web-browser-forensics-part-2http://bits.rahilparikh.me/2012/09/01/private-browsing-a-flawed-privacy/Version: 0.1 – Document Name: – Review Date: MM/DD/YYYY Page 2 of 4
Patrick Leahy Center for <strong>Digital</strong> Investigation (LCDI)More on this research project will follow at a later date. Subscribe to the blog to get the latest on this project.If you have any comments, questions, <strong>and</strong>/or suggestions, please feel free to leave a comment here on the blogor feel free to email us at LCDI@champlain.edu, putting “OS<strong>Forensics</strong>” in the subject line.Version: 0.1 – Document Name: – Review Date: MM/DD/YYYY Page 3 of 4
Change language