The forensic examination of most web browsers has proven that they dont have a provision for storing the details of privately browsed web sessions. Private browsing is provided for a purpose, i.e. privately browsing the web, whoch is being delivered.
However, in the case of Microsoft Edge even the private browsing isnt as private as it seems. Previous investigations of the browser have resulted in revealing that websites visited in private mode are also stored in the browsers WebCache file.
NOTE: The Container_n table stores web history. There a field named Flag will be available. A website visited in the private mode will have a flag value as 8. Generally the purpose of storing this information is to retrieve crashed private sessions.
\Users\user_name\AppData\Local\Microsoft\Windows\WebCache
Therefore any skilled investigator can easily spot the difference and get concrete evidence against a persons wrongdoings. Plenty of artifacts are maintained by the browser, whoch makes examination quite easy. However, there are stages where evidence is not so easy to find. The not-so-private browsing featured by Edge makes its very purpose seem to fail.
0 kommentarer