A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by BrowserHistoryView or some other software?

  • I comes to my mind that an employee may use Tor service, or similar. Which will make his traffic encrypted and much harder to spy on. – Mobutu Sese Seko Kuku Ngbendu Sep 28 '20 at 6:57

There's two ways, the hard and the easy.

The hard way: use forensic software to recover deleted files, identify the folders and files responsible for history and cache, and read those files.

The easy way: use forced proxy company-wide, and configure the network to only allow browsing by using this proxy. With user authentication enabled, it's possible to know exactly what every employee is accessing.

Either way, usually the employer have to tell every employee about the inspection and require them to acknowledge that they know about the monitoring. It depends on your jurisdiction and current laws, but usually is a good thing to do.

  • Do you have a recommendation on what forensic software to use for this purpose? – CastleCorp Sep 10 '20 at 17:41
  • Forensic software will depend on your OS, but on most cases, any "undelete" kind of software can be used for undeleting the files. – ThoriumBR Sep 10 '20 at 20:23
  • Note also that depending upon the browser and its private browsing variant, forensic recovery may not be possible. Firefox in private browsing mode never writes the history to disk, so there's nothing to recover. – user10216038 Sep 10 '20 at 20:46
  • An alternative to a forced proxy would be recording Netflow data at the corporate gateway router. – user10216038 Sep 10 '20 at 20:50
  • Yet another approach is to place monitoring software directly on the end user machine(s). This assume that the machines are corporate owned with standard disclaimers. – user10216038 Sep 10 '20 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.