How do new private browsing capabilities affect forensics?

Would love to hear from you forensic experts out there on what you think about this article.

Marlene

Previously appeared on November 12, 2008

http://blogs.techrepublic.com.com/security/?p=654&tag=nl.e019

Author:Tom Olzak

Chrome has it. IE8 and Firefox 3.1 have it. So what does it mean to forensics investigators? I’m talking about private browsing–the ability to visit sites, conduct research, or participate in illegal/unethical activities without leaving tell-tale signs behind.

Recent interest in this capability, sparked by privacy enhancements touted by Mozilla, Google, and Microsoft, prompted me to take a closer look at what this might mean to my forensics investigations. As usual, the impact on reconstructing questionable behavior depends on the browser used and the skills of both the problem employee and the investigator.

The need for private browsing

Some common reasons given for private browsing include:

• Researching a medical condition

• Shopping from a home PC for a surprise gift or vacation

• Planning a surprise birthday party

However, most family members aren’t going to know how to get around methods already provided by browsers—deleting cookies, cache content, and other session information written to disk. So these are rather weak arguments for stronger browsing privacy.