Analysis of Private Browsing Activities

Private browsing has been used by many users because of increasing awareness to browse the Internet in a private manner. The user can avoid someone to find the browsing histories and ensure no evidence of the visited sites. However, many users are not aware that the private browsing features do not meet with what it claimed to the users. Many users presume that the private browsings are secured, however, there are still flaws that can be identified. This study is conducted to examine the information obtained from the browser activities and analyze the evidence of data flows from some of private browsers. It focuses on retrieving the evidence of private browsing in RAM and hard disk as data usually are stored in local storage on user’s computer. Some tools are used to retrieve private browsing data activities and several websites tasks and parameters has been set and identified for analyzing activities. In conclusion, although using private browsers, the evidence of private browsing data activities in RAM which are important and confidential for the user can be easily retrieved using RAM imaging. For the hard disk, different private browsers save the private browsing data in the different file but most of the data are store in C:\ partition. Although all evidences of private browsing data are different due to the different development algorithm of each private browsing, some parameters such as downloaded files and bookmarks can be easily retrieved from the browsers.