International Journal of Computer Applications (0975 – 8887) Volume 147 – No. 8, August 2016 Forensics Evaluation of Privacy of Portable Web Browsers Ahmad Ghafarian Seyed Amin Hosseini Seno Department of Computer Science Department of Computer Engineering and Information Systems Faculty of Engineering University of North Georgia Ferdowsi University of Mashhad Dahlonega, GA 30005, USA Mashhad, Iran ABSTRACT relation to a computer forensic investigation is that the latter is Browsers claim private mode browsing saves no data on the a less tangible source of evidence [3]. host machine. Most popular web browsers also offer portable A study of tools and techniques for memory forensics can be versions of their browsers which can be launched from a found in [4]. The author has evaluated several command line removable device. When the removable device is removed, it and graphical user interface tools and provide the steps is claimed that traces of browsing activities will be deleted needed for memory forensics. Retrieving portable browsing and consequently private portable browsers offer better forensics artifacts left behind from main memory have privacy. This makes the task of computer forensics recently attracted some attention [5, 6]. The authors used investigators who try to reconstruct the past browsing history, limited memory forensics to retrieve forensics artifacts left in case of any computer incidence, more challenging. after a private portable browsing session. They argue that However, whether or not all data is deleted beyond forensic memory forensics is very promising in establishing a link recovery is a moot point. This research examines privacy of between the suspect and the retrieved data. popular private portable browsers, including Firefox, Chrome, Safari, and Opera through both static and volatile memory When we are dealing with portable browsing artifacts, forensics. In static memory, we examine the content of memory forensics would be challenging. This is because once registry, recent, cache, cookies and temp files. In volatile the portable browser device is ejected from the suspect memory forensics, we analyze the content of live memory. machine; the portable browser-related data content in the main Results of this experiment show that traces of web browsing memory will gradually disappear. Different browsers handle activities can be found, even after removing the portable this differently. Some browsers like Firefox replace the data browser device. with zeroes. Others delete them. This research examines privacy of the popular private portable General Terms web browsers through both static memory and volatile Computer forensics, portable browser, private browsing mode memory forensics. For RAM forensics, we capture live Keywords memory after a browsing session and then analyze the Computer forensics tools, RAM forensics, volatile memory, captured memory looking for forensics artifacts in memory. artifacts, registry and private. For static memory forensics, we examine host computer log files such as registry, cache, cookies, temporary files and 1. INTRODUCTION recent files. The experiment is carried out in both cases, by When we surf the web, browsers save information about our removing the portable browser device from the machine and surfing activities in various locations. In an attempt to leaving it attached to the machine. The results show that with maintain the privacy of users, most popular web browsers a combination of static and volatile memory forensics we can offer a private mode browsing which is claimed to not save retrieve forensically valuable information due to a private any traces of browsing activities. Most popular web browsers, portable browsing. including Mozilla Firefox, Google Chrome, Opera and Apple The remainder of this paper is organized as follows: Section 2 Safari also offer portable browsers which can be launched gives background, section 3 research methodology, results from a removable device. When the removable device is appear in section 4, section 5 covers conclusion, and future removed, it is believed that traces of browsing activities will research is shown in section 6, acknowledgement and be deleted and consequently private portable browsers offer references given in section 7 and 8 respectively. even better privacy. However, whether or not all data is deleted beyond forensic recovery is a moot point. 2. BACKGROUND Generally, web browsers save traces of browsing activities on In this section, we first review the browser’s claim of privacy the portable browser device, server and various places on the of portable web browser. Subsequently, we review the host machine [1]. The local machine saves browsing data in existing research on the privacy of private portable web both static media such as hard drive as well as random access browsers. memory (RAM), also known as volatile memory [2]. The data 2.1 Browser’s Claim of Privacy contained within the two types of sources varies significantly. Below is the privacy claim of the portable browsers that we Static media are primarily used for long term storage and have used in our experiment. contain data such as executables, images, documents and browser history. On the other hand, physical memory is a Portable Mozilla Firefox [7] statement of privacy: “Private temporary working space for data that are being used by the Browsing allows you to browse the Internet without saving system. The major difference between the data sources in any information about which sites and pages you’ve visited”. 5 International Journal of Computer Applications (0975 – 8887) Volume 147 – No. 8, August 2016 Google Chrome Portable [8] statement of privacy: “Passwords of forensically valuable data that can be extracted from Not Saved Between PCs By Default, Certificates Not physical memory. Portable, Some Settings Locked Per PC: Note that other portable browsers such as Mozilla Firefox, Portable Edition 3. RESEARCH METHODOLOGIES do not have any of the issues mentioned above.” In this section we list the hardware and software tools and the detailed process of performing the experiment. The privacy features of Opera Portable [9]: “No traces left after exiting - files are overwritten, not just deleted. Doesn't 3.1 Technology and Setup make your USB drive tired - all program files and data are In preparation for the forensics experiment, the following stored in a temporary place on the host computer. Create hardware and software tools were used. multiple profiles for use in different situations.” Hardware: The privacy feature of portable Safar [10]: “Safari's security One laptop (4GB RAM) for forensics workstation features also make surfing more secure, protecting your activities privacy. Safari stops keeping track of your web history, and storing your searches, cookies, and the data in any online Four laptops (4GB RAM) for suspect activities forms you fill out. Greater control can be found in Safari's preferences.” Four USB Flash Drive (8GB) each containing a portable web browsers 2.2 Related Research Four USB External device (8GB) to save captured Report on the privacy of Google Chrome portable browser RAM files using static media forensics appears in [11]. The authors indicate that portable Google Chrome does leave traces of SATA to USB adaptor browsing activities on the hard drive, but the details are not clear in their paper. Another study of the privacy of Google USB write blocker Chrome portable appears in [12]. The researchers examined Software: the content of the IconCache.db database, Windows registry Microsoft Windows 7, Pro 32 bits, SP1 and RAM and found evidence of portable browsing activities. However, the authors provided no details of the memory DaemonFS 1.1, file integrity monitoring software forensics process. It is worth to notice that in their experiment, the portable flash drive was still attached to the suspect Paragon DiskWipe v 12 machine, but is not clear whether the web browsers were still NirSoft Internet Tools- history, cache, and cookie open or closed after a browsing session. viewers In another study [13], the authors experimented with portable Firefox Portable 33.0, Google Chrome portable Internet Explorer, Firefox, Opera, and Google Chrome. The 42.0.2311.90, Opera portable 12.7, and Safari researchers performed memory dump and analyzed the portable 5.1.7 dumped file with hexadecimal editor. Similar to the previous research, the portable browser device was still connected to FTK Imager Lite- portable version the machine during their experiment. There is no statement to indicate the establishment of a link between retrieved SQLite Maestro software forensics artifacts and the suspect. WinHex Retrieving forensics artifacts from Windows registry keys and Mandiant Redline Memory forensics tool prefetch files due portable browsing activities can also be found in [14]. The researchers performed both live and offline DumpIt memory capture software forensics and reported evidence of portable web browsing VMware workstation 10 activities in both cases. However, their experiment description is very fuzzy and they did not disclose the portable browser 3.2 Experiment Details they experimented with. We installed VMware Workstation (VM) on all four laptops The authors in [6], along with other forensics investigation and then installed Windows 7 on VM. Subsequently, we methods, performed memory forensics with three portable installed DaemonFS [20] a tool that monitors in real time files web browsers, namely Mozilla Firefox portable,