2

I am curious about the true efficacy of the browser private mode.

I did a bit of googling and stumbled upon the following page.

http://www.magnetforensics.com/how-does-chromes-incognito-mode-affect-digital-forensics/

Apparently someone with the Internet Evidence tool can scan my machine for traces of web browsing. It talks about something like ...fewer artifacts ever hitting the disk and ultimately going into unallocated space. and However, what Chrome’s incognito mode cannot control, just like Internet Explorer’s “InPrivate” mode, is what ends up in RAM and the pagefile.sys file (virtual RAM).

I don't know a lot about this security stuff. So I list my questions in below.

  1. Does this mean that even in incognito mode Chrome will still have left traces like images, links of my browsing session on my machine?

  2. If they talk about something about the RAM (in the link above) does that mean that the traces will be gone eventually, i.e. the traces are just transient?

  3. I would also like to know if anyone with full access to my machine can obtain traces of my browsing history in the following situations.

    1. Right after I have quitted the private session.
    2. Right after (1) and rebooting my machine.
    3. With (3) done and after using the machine for a certain period of time (like a few weeks).
    4. With Chrome uninstalled.
5
  • 1
    Incognito mode is fine for nosy family members/friends but it isn't enough to completely withstand serious forensics. For example if you use an SSD you can't reliably delete information from it without wiping the whole disk. Combine that with a swapfile to get a hard to plug leak. Oct 29, 2013 at 17:02
  • Then there are threats outside its model, such as IP address being logged, browser fingerprinting etc. Oct 29, 2013 at 17:03
  • What are trying to protect against? @CodesInChaos is correct: private browsing is meant to protect against family members' snooping.
    – schroeder
    Oct 29, 2013 at 18:48
  • I am not trying to protect against anything. I am well aware of the fact that there will be IP logs, etc. and they are out of my control. It's just that I am interested to know if there will be traces, however obscure they are, residing on my machine.
    – charmsky
    Oct 30, 2013 at 0:17
  • See also this question: security.stackexchange.com/questions/64830/…
    – HRJ
    Aug 7, 2014 at 5:49

1 Answer 1

5

Incognito mode temporarily stores the cache, once you close the window, everything's gone. According to that link, very fewer details go into the Virtual Memory. But you can clear up the pagefile.sys

To wipe the free space, use tools like Eraser or CCleaner.

If not using incognito, you can clean up browsing history and cookies, you can use programs like CCleaner.

To protect your identity, take a look at project Tor or you can set up a VPN or use proxy.

5
  • 1
    Is there a pagefile.sys equivalent for MacOS?
    – charmsky
    Oct 30, 2013 at 10:42
  • And *nix equivalent would be nice too. (in this case it would be "where does Chrome keep it's cache under %OS-name%", I think) Oct 30, 2013 at 12:49
  • on *nix system, incognito mode stores data on disk cache
    – Mark Evans
    Oct 31, 2013 at 3:09
  • Even if it did not, OS can push any data including text, images, URLs, form data etc from RAM into the unencrypted swap file (pagefile.sys on windows, swap partition on nixes). Nov 1, 2013 at 9:23
  • @charmsky swap («Virtual Memory») on MacOS is encrypted by default. Nov 1, 2013 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .