Thursday, January 30, 2014

Results of running forensic software with Chrome Incognito

I worked at a company that makes forensics software and was interested in seeing if it could pick up Incognito browser history. I opened Firefox and set it to "not remember any history," then cleared the history and browsed to a few web sites. I also tried this with a private browsing tab, and with Chrome in an Incognito tab. Then I took an image of the hard drive and loaded it into our forensics software. The web sites I visited did not show up. I also checked for other traces (e.g. images from the browser cache) and did not find anything.

I also used a hard drive hex viewer and did a string search for a couple of the web sites I went to, and they weren't on there. So the browser developers appear to have done their job in keeping browser history off of your hard drive.