Web Browser Forensics in Google Chrome, Mozilla Firefox, and the Tor Browser Bundle

Nelson, Rebecca; Shukla, Atul; Smith, Cory

doi:10.1007/978-3-030-23547-5_12

Cited by 18 publications

(10 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The forensic information can be retrieved from web storage record sessions, searches, a history where complete user activity is placed [85], [86]. Every OS and Browser has its way to keep these records that can be analyzed to trace a crime [87].…”

Section: Web Forensicsmentioning

confidence: 99%

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

et al. 2022

View full text Add to dashboard Cite

With the alarmingly increasing rate of cybercrimes worldwide, there is a dire need to combat cybercrimes timely and effectively. Cyberattacks on computing machines leave certain artifacts on target device storage that can reveal the identity and behavior of cyber-criminals if processed and analyzed intelligently. Forensic agencies and law enforcement departments use several digital forensic toolkits, both commercial and open-source, to examine digital evidence. The proposed research survey focuses on identifying the current state-of-the-art digital forensics concepts in existing research, sheds light on research gaps, presents a detailed introduction of different computer forensic domains and forensic toolkits used for computer forensics in the current era. The proposed survey also presents a comparative analysis based on the tool's characteristics to facilitate investigators in tool selection during the forensics process. Finally, the proposed survey identifies and derives current challenges and future research directions in computer forensics.

show abstract

Section: Web Forensicsmentioning

confidence: 99%

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

et al. 2022

View full text Add to dashboard Cite

show abstract

“…They considered only "Browser open" and "Browser closed" scenarios for memory and storage analysis aspects. Rebecca N and et al [10], recovered forensic artifacts from normal and private browsing modes of two famous browsers i.e. Google Chrome and Mozilla Firefox.…”

Section: Iirelated Workmentioning

confidence: 99%

Forensic Analysis of Tor Browser on Windows 10 and Android 10 Operating Systems

et al. 2021

View full text Add to dashboard Cite

Smartphones and Internet have become prevalent in our society with various applications in businesses, education, healthcare, gaming, and research. One of the major issues with the Internet today is its lack of security since an eavesdropper can potentially intercept the communication. This has contributed towards an increased number of cyber-crime incidents, resulting in an increase in users' consciousness about the security and privacy of their communication. One example is the shift towards using private browsers such as Tor. Tor is a well-recognized and widely used privacy browser based on The Onion Router network that provisions anonymity over the insecure Internet. This functionality of Tor has been a major hurdle in cybercrime investigations due to the complex nature of its anonymity. This paper investigates artifacts from the Tor privacy browser on the latest Windows 10 and Android 10 devices to determine potential areas where evidence can be found. We examine the registry, storage, and memory of Windows 10 devices and the memory, storage, logs, and Zram of Android 10 devices for three possible scenarios i.e. before, during, and after use of the Tor browser. Our results do not support the claims made by the Tor Project regarding user privacy and anonymity. We find that it is possible to retrieve significant details about a user's browsing activities while the Tor browser is in use as well as after it is closed (on both operating systems). This paper also provides an investigative methodology for the acquisition and analysis of Tor browser artifacts from different areas of the targeted operating systems. Therefore, it can serve as a base to expand research in the forensic analysis of other privacy browsers and improve the efficiency of cybercrime investigations efficiency.

show abstract

“…Incognito mode was made available in December 2008. As explained by [25], this allows users to browse the internet without worrying about any of their browsing activity being stored on their computers.…”

Section: Private Browsers Overview and Scopementioning

confidence: 99%

“…This privacy-focused browser aims to provide an intuitive and aesthetically pleasing user interface. In the research by [25], Firefox is used as one of the main components of the TOR browser. The private browsing feature within Firefox first became available in 2009 and purports to be one of the best browsers in helping to protect a user's privacy as well as preventing websites and ads from harvesting web browsing information [28].…”

Section: Private Browsers Overview and Scopementioning

confidence: 99%

Browsers’ Private Mode: Is It What We Were Promised?

Hughes¹,

Papadopoulos²,

Pitropakis³

et al. 2021

Computers

View full text Add to dashboard Cite

Web browsers are one of the most used applications on every computational device in our days. Hence, they play a pivotal role in any forensic investigation and help determine if nefarious or suspicious activity has occurred on that device. Our study investigates the usage of private mode and browsing artefacts within four prevalent web browsers and is focused on analyzing both hard disk and random access memory. Forensic analysis on the target device showed that using private mode matched each of the web browser vendors’ claims, such as that browsing activity, search history, cookies and temporary files that are not saved in the device’s hard disks. However, in volatile memory analysis, a majority of artefacts within the test cases were retrieved. Hence, a malicious actor performing a similar approach could potentially retrieve sensitive information left behind on the device without the user’s consent.

show abstract

Web Browser Forensics in Google Chrome, Mozilla Firefox, and the Tor Browser Bundle

Cited by 18 publications

References 5 publications

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

Forensic Analysis of Tor Browser on Windows 10 and Android 10 Operating Systems

Browsers’ Private Mode: Is It What We Were Promised?

Contact Info

Product

Resources

About