Chrome incognito forensic analysis in case of abrupt shutdown

Question

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still.

But there's been lack of discussions on what can be additionally done when users abruptly shut down their computers. For example, a search raid could be done for some suspects, and suspects may choose to simply pull plugs off, because of pressure or rush.

In this circumstance, there seem to be additional data to work with, but it is hard to information on that, because Google does not give good technical primers on how incognito mode works, and thus this question. What would be additional data available for forensic analysis of incognito mode uses when computer was abruptly shut down (not normal shotdown, but more like power outage)?

Answer 1

Swap / pagefile

If memory pressure on the target machine is high, there is a chance that some pages of memory from the browser process are swapped out onto the disk (the pagefile on Windows and the swap file on Linux). On modern systems with plenty of RAM, very little, if anything, is swapped out. Additionally, this swap space is sometimes encrypted, with the key kept only in memory. The key is random and so cannot be cracked. Newer versions of Windows may do this by default. Older versions require the user manually enable encryption of the swap space. When the swap file is encrypted, or when the disk containing the swap file is encrypted, then shutting the computer off (whether naturally or by unceremoniously unplugging the device) will result in the key vanishing.

Downloaded files

Whenever a download prompt is opened, the file to be downloaded starts automatically being saved, usually with the .crdownload extension. This downloading occurs even if the user cancels the download or does not even accept it. This is done as an optimization to improve apparent download speed. If the user does not specify a filename to save it as and begin the download, then the temporary file will be deleted as soon as the prompt is closed. You may be able to infer what sites were visited by looking in unallocated filesystem space for these remnants.

There may be reasons a user has inadvertently triggered the download prompt. Some links, when clicked, access a resource where an HTTP header causes the file to be downloaded rather than be opened inline in the browser. Additionally, a user who is used to using browser shortcuts may accidentally press ctrl+s, which opens a download prompt for the current page.

Summary

Incognito mode makes an effort to not save anything persistently to the disk. This means there will be no cookies, no local storage, no history, etc. If you do not have access to logs from the ISP or anything similar, you will not be able to determine what sites have been accessed if the target's computer where the incognito browser is running has shut down. Note that this will be even more difficult if encryption is being used, since that will also protect swap space or temporary files.

In all these cases, you should make an exact forensic copy of the storage device and keep a strong cryptographic hash of it elsewhere to ensure it could not have been tampered with. Unless you clone the disk in this way, there will be the risk that the computer will have powered up automatically (e.g. due to Wake-on-LAN), rendering obtained evidence potentially inadmissible.