Private Browsing Forensics

Austen Wells


Supervised by Michael Daley; Moderated by Xianfang Sun

The aim of this project is to investigate if Private Browsing on the web is truly private. A thorough investigation will be conducted to uncover any left-over data/information after a Private Browsing session across the five major web browsers: Internet Explorer, Microsoft Edge, Safari, Google Chrome, and Mozilla Firefox. This research will be used to highlight which Private Browser is most private.

The five privacy modes that were probed in this project were: ‘InPrivate Browsing’ in Internet Explorer, ’InPrivate’ in Microsoft Edge, ‘Private Browsing’ in Safari, ‘Incognito’ in Google Chrome, and ‘Private Browsing’ in Mozilla Firefox.

A Virtual Machine was used to create a Snapshot for each Windows operating system (O/S) based web browser and then a MacOS was used for Safari web browser to take a forensic image and memory dump of each browsing session and outputting the result to an external drive. Using appropriate forensic toolkits for each image or memory dump to examine the data captured from the browsing session to ascertain whether or not private browsing on a particular web browser is truly private.

Initial Plan (04/02/2019) [Zip Archive]

Final Report (09/05/2019) [Zip Archive]

Publication Form