ComputerForensicsDigest.com

There is growing awareness that the trend towards inclusion of a "private browsing" in Web browsers may make it more difficult (or at least less fruitful) to conduct computer forensic examinations in the future.

On the TechRepublic website, Tom Olzak, Director of Information Security at HCR Manor Care in Ohio, has a new blog posting entitled "How do new private browsing capabilities affect forensics?" He provides a brief overview of how the new feature will work in the various browsers and then discusses some of the implications for computer forensic examiners and corporate IT departments.

According to Olzak, the InPrivateBrowsing feature of Microsoft Internet Explorer actually does not do a very thorough job of protecting user privacy, since information about the browsing session is still written to disk. Remarkably, the software still adds entries to the browser history files and to the Internet cache. Those may be hidden from the average searcher, but not from computer forensic tools.

The approach taken by Mozilla Firefox is more thorough. Privacy mode prevents any data from being written to the hard disk; instead, information about the browsing session is held in memory and cleared when the private session is ended.

There is some discussion that in enterprise settings, IT Departments may disable "private mode" for security and productivity methods. But even if they do not, employees should assume that privacy mode is actually private. First, the increased use of "live forensics" means that there will be some instances in which private sessions are interrupted and the data captured from memory.

Second, privacy mode will not prevent an employer from tracking an employee's computer activity through a keystroke logging program. A surprisingly large percentage of companies have deployed such software, and these types of browser innovations may spur more to do so.