Skip to main content

Table 5 Browser analysis during private browsing sessions

From: Do private and portable web browsers leave incriminating evidence?: a forensic analysis of residual artifacts from private and portable web browsing sessions

Private browser

Noticeable change

IE InPrivate Browsing

Everything gets deleted when exiting the browser and the entire session is terminated

Google Chrome Incognito Mode

Safe Browsing databases, Cookies, and History are modified, no changes during session but the chrome_shutdown_ms.txt is replaced with a new timestamp when session ends

Firefox Private Browsing

Safe Browsing database gets modified, nothing appears to be written while surfing, but when session ends, some Firefox\Profile files are modified

Safari Private Browsing

Only NTuser.dat appears to be modified