Forensics Analysis of Privacy of Portable Web Browsers

View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Embry-Riddle Aeronautical University 2016 Annual ADFSL Conference on Digital Forensics, Security and Law Proceedings May 25th, 1:00 PM Forensics Analysis of Privacy of Portable Web Browsers Ahmad Ghafarian Department of Computer Science and Information Systems, Mike Cottrell College of Business, [email protected] Follow this and additional works at: https://commons.erau.edu/adfsl Part of the Aviation Safety and Security Commons, Computer Law Commons, Defense and Security Studies Commons, Forensic Science and Technology Commons, Information Security Commons, National Security Law Commons, OS and Networks Commons, Other Computer Sciences Commons, and the Social Control, Law, Crime, and Deviance Commons Scholarly Commons Citation Ghafarian, Ahmad, "Forensics Analysis of Privacy of Portable Web Browsers" (2016). Annual ADFSL Conference on Digital Forensics, Security and Law. 9. https://commons.erau.edu/adfsl/2016/wednesday/9 This Peer Reviewed Paper is brought to you for free and open access by the Conferences at Scholarly Commons. It has been accepted for inclusion in Annual ADFSL Conference on Digital Forensics, Security and Law by an (c)ADFSL authorized administrator of Scholarly Commons. For more information, please contact [email protected]. Forensics Analysis of Privacy of Portable Web … CDFSL Proceedings 2016 FORENSICS ANALYSIS OF PRIVACY OF PORTABLE WEB BROWSERS Ahmad Ghafarian Department of Computer Science and Information Systems Mike Cottrell College of Business University of North Georgia, Dahlonega, GA 30597, USA [email protected] ABSTRACT Web browser vendors offer a portable web browser option which is considered as one of the features that provides user privacy. Portable web browser is a browser that can be launched from a USB flash drive without the need for its installation on the host machine. Most popular web browsers have portable versions of their browsers as well. Portable web browsing poses a great challenge to computer forensic investigators who try to reconstruct the past browsing history, in case of any computer incidence. This research examines various sources in the host machine such as physical memory, temporary, recent, event files, Windows Registry, and Cache.dll files for the evidential information regarding portable browsing session. The portable browsers under this study include Firefox, Chrome, Safari, and Opera. Results of this experiment show that portable web browsers do not provide user-privacy as they are expected to do. Keywords: computer forensics tools, RAM forensics, volatile memory, forensics artifacts, Registry INTRODUCTION memory (Aggarwal and Jackson, 2010). The data that is contained within the two types of When surfing the web, browsers save sources varies significantly. Static media is information about the surfing activities in primarily used for long term storage and various locations. In an attempt to maintain contains data such as executables, images, privacy of web browsing, most major web documents, and browser history. On the other browsers have a portable version of their hand, physical memory is a temporary working browsers. A portable browser is a browser that space for data that are being used by the can be saved on a removable storage media system. The major difference between the data such as a USB flash drive. The browser can sources in relation to a computer-forensic then be launched from the flash drive without investigation is that the latter is a less tangible the need for its installation on the host source of evidence (Simmons & Slay, 2009). machine (Choi, et al, 2012). From computer- forensics point of view, browsing artifacts can Forensics artifacts left after a portable be saved on the portable browser flash drive, browsing session can be retrieved from sources server and the host machine. The local such as caches, history, cookies, and download machine saves browsing data in both static file lists (Davis, 2009). On the other hand, media such as hard drive as well as random retrieving portable browsing forensics artifacts access memory (RAM), also known as volatile left behind from main memory have recently © 2016 ADFSL Page 183 ADFSL Conference Proceedings 2016 Forensics Analysis of Privacy of Portable Web … attracted some attention (Oh et al, 2011) LITERATURE REVIEW (Shashidhar, 2013). The authors have used limited memory forensics to retrieve forensics In this section, we review the previous work on data left after a portable browsing session. portable browsing forensics. We study portable They argue that memory forensics is very browsing artifacts retrievable from static media promising in establishing a link between the and from main memory. suspect and the retrieved data. Static Media Forensics When we are dealing with portable Static media forensics related to the artifacts browsing artifacts, memory forensics would be left due a portable browsing session has been challenging because once we remove the studied by various researchers. For example, portable browser flash media from the suspect Marrington et al (2013) has examined privacy machine, the portable browser-related data of Google Chrome portable web browser using content in the main memory will gradually be conventional forensics by taking an image of deleted. the hard drive after a portable browsing The focus of this research is the session and analyzed the image. The details of examination of various sources such as main the analysis are not clear in their paper. They memory, temporary files, recent files, event reported that portable Google Chrome does files, Windows Registry, and Cache.dll file in leave traces of browsing activities on the hard the suspect machine looking for residual drive. In another research, privacy of the artifacts left behind after private portable web portable Google Chrome has been studied by browsing activities. The research Adautin and Meeran (2015). The researchers experimentally analyzes both static media examined the content of the IconCache.db sources such as hard drive as well as volatile database as well as Windows Registry and memory for their evidential potential related to reported that they found evidence of portable portable web browser activities. The portable browsing activities. They claim that they browsers under this study include Firefox, examined the content of volatile memory; Google Chrome, Opera and Safari. To however, other than making some general evaluate the effectiveness of browser closure recommendations, the authors provided no after a browsing session, the experiment is details of their RAM forensics process. It is carried out in two cases: 1) portable browser worthwhile to notice that in both cases of hard flash drive left attached to the suspect machine drive forensics and volatile memory forensic, after a browsing session and 2) portable they left the portable flash drive connected to browser flash drive was removed from the the suspect machine during their experiment. suspect machine after a browsing session. The Dharan and Meeran (2014) have reported results will be tabulated for comparison that portable web browsing activities can be purposes. obtained by searching the Windows Registry The remainder of this paper is organized as and Prefetch files. The researchers performed follows: Section 2 gives literature review, both live and offline forensics and reported section 3 provides research methodology, evidence of portable web browsing activities in results appear in section 4, section 5 covers both cases. However, their experiment conclusion and future research is presented in description is very fuzzy and they did not section 6. disclose the portable browser with which they experimented. Page 184 © 2016 ADFSL Forensics Analysis of Privacy of Portable Web … CDFSL Proceedings 2016 Memory Forensics be confirmed. In special cases, if the search word information is encoded in unfamiliar Memory forensics involves two steps, memory characters, this tool provides a decoding capture and analysis of the captured memory. function. RAM capture is the process of making an image of the physical memory and saving it as Other researchers have explored memory a file on an external storage media. Memory forensics in relation to private browsing mode; analysis involves parsing the data structure however, in both cases of private browsing and tree of the captured memory file, looking for private portable browsing, the process of RAM processes that were running when the memory forensics and the objective remain the same, was taken as well as other data such as which is maintaining privacy of the user. For passwords, downloaded files, SSL Certificates, this reason, we briefly review some of the URLs, etc. To facilitate memory forensics, important memory forensics research findings several open-source and proprietary RAM here. forensics tools have been developed. Some Mahendrakar, et al. (2010) examined examples include Volatility (2015), Redline various popular web browsers in private mode (2015), and WinHex (2015). to determine traces of browsing activities that One of the most comprehensive portable remain in physical memory. They created a browsing forensics researches is the work of website which contained individual pages that Ohana and Shashidhar (2013). Along with required the browser to interact with various other forensics investigation methods, the types of data including SSL certificates, form researchers performed RAM forensics

Load more