keywords

Web browsers are used on a daily basis to perform many various online activities, such as searching for information, shopping and conducting payment transactions. Web browsers log and store a large amount of data concerning users’ browsing activities, including caching files, visited URL’s, search terms and cookies. These are retained on the user’s computer and are easily located by other users. The use of a browser’s public mode therefore facilitates a digital forensic investigator’s examination of a suspect’s internet activities, as is needed in cases where questionable web sites were visited or criminal acts were conducted through the Internet. However, over the past few years, vendors of the major web browsers have expressed concern over users’ privacy while browsing the Internet. This has entailed their development of a new feature, the “private browsing” mode, with the aim of enabling users to browse the Internet whilst leaving no trace of their browsing activity. Although private browsing modes may be deployed by some users for a variety of respectable reasons, such as buying a surprise gift, they can also be exploited by cyber criminals for nefarious activities. The endeavours of these criminals to thoroughly erase any evidence of their Internet browsing activities seem to be facilitated by the private browsing modes. For example, they can prevent the inscription of an individual’s private browsing data on the hard drive, assisting criminals by leaving none of the evidential artifacts which can be vital in a court of law.

This paper aims to investigate the effectiveness of the private browsing modes built into four major Internet browsers: Google Chrome Incognito, Mozilla Firefox Private Browsing Mode, Internet Explorer InPrivate and Apple Safari Private Browsing Mode. To achieve this, a set of identical experiments is carried out on private browsing mode of each of the four web browsers, using selected pre-defined web browsing activities. The forensic analysis is conducted in two stages. Firstly, the analysis is performed on both “common” and “uncommon” locations on the hard drive; and the second stage involves investigating Physical Memory (RAM). This is to investigate whether each browser, while in private mode, leaves browsing artifacts or not in these locations.

Private browsing modes have different names according to the browser. It is called “Incognito Mode” in Chrome [1], “InPrivate Browsing” in Internet Explorer [2], “Private Browsing” in Firefox [3] and “Private Browsing” in Safari [4]. “Private Browsing” was first released by Apple Safari in 2005 [5]. Following the same principle Google Chrome and Microsoft introduced “Incognito” and “InPrivate” respectively in 2008 [6]. Mozilla’s “Private Browsing” was introduced in 2009 [7]. The most common reasons cited by vendors for providing private modes are to enable shopping for surprise gifts on a family PC [2] and the planning of surprise parties [1]. However, through their research work, Aggarwal et al. [8] revealed that in reality the searching of adult websites was the primary reason for utilizing private modes [8]. Using a particular technique, Aggarwal et al. [8] posted advertisements on ad-networks to target various categories of websites including adult and gift websites “to correlate the use of private mode with the type of website being visited”. This experiment revealed that private browsing was more popular at adult sites than gift buying websites.

Two distinct goals must be met in order for a private mode to be considered safe and secure. The first goal is security against a local attacker (“an attacker who controls the user’s machine”) and the second goal is security against a web attacker (“an attacker who controls websites the user visits”) [8]. Regarding the local attacker, while in private mode browsers should be able to prevent the sites visited from placing browsing artifacts on the user’s machine. For web attackers, browsers should make it impossible for websites to find out whether a particular user has previously visited them by preventing websites from linking users’ activities whilst in private and public modes. Although the web attacker model has been previously researched to some extent [8, 9, 10], the concept of the local attacker has not been addressed adequately. No paper was found that investigates private browsing modes except the research conducted by Said et al. [12]. However, Said et al’s [12] results cannot be considered accurate as they conducted their experiments on a polluted system. Moreover, they carried out their experiments on older versions of the web browsers’ private modes. Therefore, it was decided to conduct new experiments to provide a better understanding of this phenomenon and to find out how this feature could affect digital forensic investigations.

The presented set of browsing activities was run identically on the snapshots of the virtual machine in the private browsing modes in order to determine whether any of the following browsing artifacts could be recovered; cached web pages, web browsing history, download history, visited URLs, search terms used in the Google search engine or website search options. In the search for browsing artifacts, images of Physical Memory (RAM) were also captured for analysis. Physical Memory contains volatile data which can be lost once the machine is switched off. Therefore, the decision to investigate RAM was made with a view in emulating a realistic police raid scenario, where officers must carry out a live investigation of the suspect’s machine before turning it off and removing it for further analysis.

Identical test was performed on each web browser’s private mode inside its respective snapshot of the virtual machine. Upon the completion of each experiment and prior to closing down a particular web browser’s private mode, RAM was imaged and verified through matching MD5 and SHA1 checksums using FTK Imager 3.1.2. The private mode session was then terminated by closing down the private browsing window. Using FTK Imager again, the virtual hard drive of the snapshot was then imaged and verified through corresponding MD5 and SHA1 checksums.

The first part of the analysis involved the examination of different locations on the hard drive image. The hard drive image of each snapshot was separately imported to Autopsy and FTK for examination. Four different cases were then built for four different experiments on the private browsing modes. Both “common” and “uncommon” locations on the hard drive were analyzed to identify whether traces of the browsing activities carried out in private mode could be found.

The second part of the analysis required examination of the captured image of the RAM of each snapshot for each particular experiment on the private browsing mode. As with the hard drive examination, four different cases were built for four different experiments on the private browsing modes. FTK 1.81.6 and WinHex were deployed for the examination of the RAM images due to their useful and powerful capabilities. In this way, the RAM images were analyzed to search for any browsing artifacts from the experiments on the private mode sessions.

This project analyzed the effectiveness of the “private” modes of four widely deployed web browsers, resulting in the discovery of numerous weaknesses in their implementation which preclude them from meeting their desired security goals. As regards the “local attacker model”, experiments carried out in this project exposed the reality that the “private” browsers of Mozilla Firefox, Internet Explorer and Apple Safari cannot keep browsing activities private from a local attacker, such as a forensic examiner. All three left behind various types of browsing data in both “common” and “uncommon” locations on the hard drive. Consequently, although the “private” modes of Mozilla Firefox, Internet Explorer and Apple Safari might offer regular users some degree of privacy against other regular users of the same machine at a local level of Internet information, they cannot conceal the user’s private browsing activity from a dedicated computer forensic expert. Therefore, the level of privacy provided by these three major browsers is at best sufficient for only the average user. In contrast, this project’s experiments on the “private” browsing mode of Google Chrome revealed that it is completely private, not leaving any browsing artifact in either “common” or “uncommon” locations on the hard drive. These results conflict with the results achieved by Said et al. [12], where Google Chrome is disregarded as a completely private mode. However, this could be explained by the fact that Said et. al’s [12] experiment was conducted on an older version of Google Chrome. It is important to note that all four web browsers leave behind “private” browsing artifacts in the “Physical Memory” (RAM). Therefore, on seizing a suspect’s computer whilst it is still turned on, a forensic examiner could recover from the RAM all browsing activities carried out during the “private” browsing session. The opportunity to recover such data if a computer is seized after the machine is turned off is greatly reduced, as the volatile nature of RAM may cause the data to be lost.

A dedicated computer forensic investigator is able to recover many forensic browsing artifacts by using effective forensic tools and techniques. This contradicts the professed advantages of “private” modes, making it arguable that “private” modes are not in reality private at all. Nevertheless, the prospect of reconstructing the suspicious behaviour of a person using a “private” mode is dependent on the variety of the “private” browser used and the skills of both the forensic investigator and suspect. For example, a forensic investigator would more easily retrieve evidential artifacts from a computer where a suspect had utilized the “private” modes of Internet Explorer or Apple Safari rather than Mozilla Firefox, as they are less secure. The difficulty of recovery increases in proportion to the suspect’s knowledge of digital forensic techniques and tools, such as the methods of manually deleting any remaining data not effectively removed by the browser. However, even where a suspect had no such knowledge, a forensic investigator would be unable to recover “private” browsing data where Google Chrome had been used, as no such data is left in Google Chrome’s “private” mode.

Future work should be extended to investigate the browser add-ons to determine whether these add-ons undermine the security of “private” browsers by leaking data onto the hard drive. This has not been verified by any experiment, being outside of the scope of this project.