A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by BrowserHistoryView or some other software?
1
-
I comes to my mind that an employee may use Tor service, or similar. Which will make his traffic encrypted and much harder to spy on.– Mobutu Sese Seko Kuku NgbenduSep 28, 2020 at 6:57
Add a comment
|
1 Answer
There's two ways, the hard and the easy.
The hard way: use forensic software to recover deleted files, identify the folders and files responsible for history and cache, and read those files.
The easy way: use forced proxy company-wide, and configure the network to only allow browsing by using this proxy. With user authentication enabled, it's possible to know exactly what every employee is accessing.
Either way, usually the employer have to tell every employee about the inspection and require them to acknowledge that they know about the monitoring. It depends on your jurisdiction and current laws, but usually is a good thing to do.
answered Sep 10, 2020 at 17:16
-
Do you have a recommendation on what forensic software to use for this purpose? Sep 10, 2020 at 17:41
-
Forensic software will depend on your OS, but on most cases, any "undelete" kind of software can be used for undeleting the files. Sep 10, 2020 at 20:23
-
Note also that depending upon the browser and its private browsing variant, forensic recovery may not be possible. Firefox in private browsing mode never writes the history to disk, so there's nothing to recover. Sep 10, 2020 at 20:46
-
An alternative to a forced proxy would be recording Netflow data at the corporate gateway router. Sep 10, 2020 at 20:50
-
Yet another approach is to place monitoring software directly on the end user machine(s). This assume that the machines are corporate owned with standard disclaimers. Sep 10, 2020 at 20:54