Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible?

If so, suppose that a computer has been shut down right after usage of InPrivate browsing in IE (e.g. there are tabs opened, and users just shut down the whole computer without shutting down windows.) How much would history be likely recovered?

share|improve this question
How much history you'll get depends quite a lot depending on circumstances like a clean shutdown, how much time has passed between use, if the files have been overwritten etc – NULLZ May 20 '13 at 13:39

There are various differences in the implementation of inprivate browsing for IE based on which version of IE you are using. IE 8 inprivate browsing was was supposed to be quite good, whereas IE 9 reportedly had many issues.

Encase is just a piece of software that can do advanced forensics. Since It can read deleted files off the drive (depending on the circumstances) and since IE inprivate browsing writes files to disk, it is possible to recover these using a piece of software such as EnCase. then its simply a matter of creating the forensic timeline to piece together the information your after from the extracted files.

There's a few relevant links i've found here and also here

share|improve this answer

In all cases, Internet Explorer using InPrivate doesn't store records of the visited URLs or the cookies of an InPrivate session on the disk. It does, however, store cached files (.html files, images, videos..) of the InPrivate session, but it removes them when you close the browser. So we have two cases here

  • Shutting down before closing the browser: Browsing history will not be retrievable, but cached files will stay on the disk. Please note that in most cases, normal shutdown closes the opened applications and waits for them to close safely. Of course, it's different when there's a power failure or you use Sleep/Hibernate.

  • Shutting down after closing the browser: Browsing history and cached files will not be there, but it could be possible to retrieve cached files using data recovery methods.

For more information on what InPrivate stores on disk or memory, check the relevant pages by Microsoft for Internet Explorer 8 and Internet Explorer 9.

So in conclusion: It is possible for Encase to recover the cached files of your browsing session but not the browsing logs themselves (history of visited URLs).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.