Swap / pagefile
If memory pressure on the target machine is high, there is a chance that some pages of memory from the browser process are swapped out onto the disk (the pagefile on Windows and the swap file on Linux). On modern systems with plenty of RAM, very little, if anything, is swapped out. Additionally, this swap space is sometimes encrypted, with the key kept only in memory. The key is random and so cannot be cracked. Newer versions of Windows may do this by default. Older versions require the user manually enable encryption of the swap space. When the swap file is encrypted, or when the disk containing the swap file is encrypted, then shutting the computer off (whether naturally or by unceremoniously unplugging the device) will result in the key vanishing.
Downloaded files
Whenever a download prompt is opened, the file to be downloaded starts automatically being saved, usually with the .crdownload
extension. This downloading occurs even if the user cancels the download or does not even accept it. This is done as an optimization to improve apparent download speed. If the user does not specify a filename to save it as and begin the download, then the temporary file will be deleted as soon as the prompt is closed. You may be able to infer what sites were visited by looking in unallocated filesystem space for these remnants.
There may be reasons a user has inadvertently triggered the download prompt. Some links, when clicked, access a resource where an HTTP header causes the file to be downloaded rather than be opened inline in the browser. Additionally, a user who is used to using browser shortcuts may accidentally press ctrl+s, which opens a download prompt for the current page.
Summary
Incognito mode makes an effort to not save anything persistently to the disk. This means there will be no cookies, no local storage, no history, etc. If you do not have access to logs from the ISP or anything similar, you will not be able to determine what sites have been accessed if the target's computer where the incognito browser is running has shut down. Note that this will be even more difficult if encryption is being used, since that will also protect swap space or temporary files.
In all these cases, you should make an exact forensic copy of the storage device and keep a strong cryptographic hash of it elsewhere to ensure it could not have been tampered with. Unless you clone the disk in this way, there will be the risk that the computer will have powered up automatically (e.g. due to Wake-on-LAN), rendering obtained evidence potentially inadmissible.