Most popular web browsers support private browsing mode. It is claimed that private browsing mode protects privacy by leaving no trace of surfing activities behind. Yet it poses a great challenge to the computer forensics investigators who try to reconstruct the past browsing history, in case of any computer incidence. The aim of this research is to use volatile memory forensics methodologies and tools to examine the artifacts left in main memory after a private browsing session. To achieve this goal, it first presents a memory forensics framework that will help the investigators to effectively capture and analyze memory associated with private browsing with respect to incidence response. It then uses the framework to experimentally capture and analyze the memory, for its evidential potential related to private browsing using Firefox, Google Chrome, IE and Safari. We also report the degree of privacy offered by the browsers under study.

Keywords