Forensic Analysis of Residual Artifacts from Private Browsing Sessions in Linux

Abstract

Private browsing is a common feature in modern web browsers to ensure the privacy of the user by disabling the history and other cached information about web browsing. User can browse the Internet after enabling private browsing feature in which no user data will be stored such as browsing history, auto fill data, user credentials, and cookie information. It is important to retrieve residual data related to one’s normal and private browsing sessions available in his computer to prove his role in an offence or incident. This is critical and tricky in any cybercrime or physical crime where a computer is being used by the accused to browse Internet as conviction rates of cybercrimes are less than 10 % due to lack of proper evidences. This project is an analysis for residual artifacts from private browsing sessions in Linux platform using popular web browsers. Analysis result shows the possibility of retrieving evidences in such browsing scenarios and they are purely based on real-world web browsing sessions. Both Static and Live memory analysis are used. The tools and techniques used in this project are widely used and forensically sound.