Skip to main content
EURASIP Journal on Information Security

Table 6 Browser analysis using portable web browsers

From: Do private and portable web browsers leave incriminating evidence?: a forensic analysis of residual artifacts from private and portable web browsing sessions

Portable browser

Host machine activity

Opera portable

Temp files appear to be created on disk and then are deleted when session ends

Firefox portable

Mozilla\Roaming directory was modified, and a few temp files under Local AppData were created/deleted

Google chrome portable

Folder called GoogleChromePortable had files created, modified, and deleted, including Sys32\Winevt\Logs, and Portable Chrome Cache

Safari portable

Setup files are portable but must be installed on system (not standalone.exe) therefore will not be used for testing

Back to article page