Thursday, January 30, 2014

Results of running forensic software with Chrome Incognito

I worked at a company that makes forensics software and was interested in seeing if it could pick up Incognito browser history. I opened Firefox and set it to "not remember any history," then cleared the history and browsed to a few web sites. I also tried this with a private browsing tab, and with Chrome in an Incognito tab. Then I took an image of the hard drive and loaded it into our forensics software. The web sites I visited did not show up. I also checked for other traces (e.g. images from the browser cache) and did not find anything.

I also used a hard drive hex viewer and did a string search for a couple of the web sites I went to, and they weren't on there. So the browser developers appear to have done their job in keeping browser history off of your hard drive.

No comments:

Virtualbox Crashing when pulling up the Optical Drives Menu

 I'm still running an old version of Virtualbox (5.2.20), which is probably unsupported at this point.  One day, it started crashing whe...