Analysis of Privacy of Private Browsing Mode through Memory Forensics

Abstract

Most popular web browsers support private browsing mode. It is claimed that private browsing mode protects privacy by leaving no trace of surfing activities behind. Yet it poses a great challenge to the computer forensics investigators who try to reconstruct the past browsing history, in case of any computer incidence. The aim of this research is to use volatile memory forensics methodologies and tools to examine the artifacts left in main memory after a private browsing session. To achieve this goal, it first presents a memory forensics framework that will help the investigators to effectively capture and analyze memory associated with private browsing with respect to incidence response. It then uses the framework to experimentally capture and analyze the memory, for its evidential potential related to private browsing using Firefox, Google Chrome, IE and Safari. We also report the degree of privacy offered by the browsers under study.

Forensic analysis of iOS binary cookie files

“…Memory forensics plays a crucial role in browser forensics as it involves the analysis of artifacts left in the volatile memory after a browsing session. Ghafarian and Seno [9] performed research on the analysis of privacy in private browsing mode through memory forensics. They developed a memory forensics framework to capture and analyze memory associated with private browsing sessions.…”

A Study on Private Browsing in Windows Environment

“…As of late, forensic investigators play an essential role to recover these data by using forensic tools and techniques [7]. Furthermore, researcher [8] said that private browsing had been proven not to deliver the security as they ensure they would, therefore, encouraging researchers to analyse the browser artefacts of Private Browsing mode in different forms, either using local machines or virtual machines to examine the feature [9].…”