Private browsing: a window of forensic opportunity

Research output: Contribution to journalArticle

Full text download(s)

Published copy (DOI)



Publication details

JournalDigital Investigation
DateAccepted/In press - 22 Nov 2013
DatePublished (current) - Mar 2014
Issue number1
Number of pages10
Pages (from-to)20-29
Original languageEnglish


The release of Internet Explorer 10 marks a significant change in how browsing artifacts are stored in the Windows file system, moving away from well-understood Index.dat files to use a high performance database, the Extensible Storage Engine. Researchers have suggested that despite this change there remain forensic opportunities to recover InPrivate browsing records from the new browser. The prospect of recovering such evidence, together with its potential forensic significance, prompts questions including where and when such evidence can be recovered, and if it is possible to prove that a recovered artefact originated from InPrivate browsing. This paper reports the results of experiments which answer these questions, and also provides some explanation of the increasingly complex data structures used to record Internet activity from both the desktop and Windows 8 Applications. We conclude that there is a time window between the private browsing session and the next use of the browser in which browsing records may be carved from database log files, after which it is necessary to carve from other areas of disk. It proved possible to recover a substantial record of a user’s InPrivate browsing, and to reliably associate such records with InPrivate browsing.

Bibliographical note

This is an author-produced version of the published paper. Uploaded in accordance with the publisher’s self-archiving policy.

    Research areas

  • Digital forensics Internet Explorer Microsoft windows Database Carving

Discover related content

Find related publications, people, projects, datasets and more using interactive charts.

View graph of relations