I am curious about the true efficacy of the browser private mode.

I did a bit of googling and stumbled upon the following page.


Apparently someone with the Internet Evidence tool can scan my machine for traces of web browsing. It talks about something like ...fewer artifacts ever hitting the disk and ultimately going into unallocated space. and However, what Chrome’s incognito mode cannot control, just like Internet Explorer’s “InPrivate” mode, is what ends up in RAM and the pagefile.sys file (virtual RAM).

I don't know a lot about this security stuff. So I list my questions in below.

  1. Does this mean that even in incognito mode Chrome will still have left traces like images, links of my browsing session on my machine?

  2. If they talk about something about the RAM (in the link above) does that mean that the traces will be gone eventually, i.e. the traces are just transient?

  3. I would also like to know if anyone with full access to my machine can obtain traces of my browsing history in the following situations.

    1. Right after I have quitted the private session.
    2. Right after (1) and rebooting my machine.
    3. With (3) done and after using the machine for a certain period of time (like a few weeks).
    4. With Chrome uninstalled.
  • 1
    Incognito mode is fine for nosy family members/friends but it isn't enough to completely withstand serious forensics. For example if you use an SSD you can't reliably delete information from it without wiping the whole disk. Combine that with a swapfile to get a hard to plug leak. Oct 29 '13 at 17:02
  • Then there are threats outside its model, such as IP address being logged, browser fingerprinting etc. Oct 29 '13 at 17:03
  • What are trying to protect against? @CodesInChaos is correct: private browsing is meant to protect against family members' snooping.
    – schroeder
    Oct 29 '13 at 18:48
  • I am not trying to protect against anything. I am well aware of the fact that there will be IP logs, etc. and they are out of my control. It's just that I am interested to know if there will be traces, however obscure they are, residing on my machine.
    – charmsky
    Oct 30 '13 at 0:17
  • See also this question: security.stackexchange.com/questions/64830/…
    – HRJ
    Aug 7 '14 at 5:49

Incognito mode temporarily stores the cache, once you close the window, everything's gone. According to that link, very fewer details go into the Virtual Memory. But you can clear up the pagefile.sys

To wipe the free space, use tools like Eraser or CCleaner.

If not using incognito, you can clean up browsing history and cookies, you can use programs like CCleaner.

To protect your identity, take a look at project Tor or you can set up a VPN or use proxy.

  • 1
    Is there a pagefile.sys equivalent for MacOS?
    – charmsky
    Oct 30 '13 at 10:42
  • And *nix equivalent would be nice too. (in this case it would be "where does Chrome keep it's cache under %OS-name%", I think)
    – НЛО
    Oct 30 '13 at 12:49
  • on *nix system, incognito mode stores data on disk cache
    – Mark Evans
    Oct 31 '13 at 3:09
  • Even if it did not, OS can push any data including text, images, URLs, form data etc from RAM into the unencrypted swap file (pagefile.sys on windows, swap partition on nixes). Nov 1 '13 at 9:23
  • @charmsky swap («Virtual Memory») on MacOS is encrypted by default. Nov 1 '13 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.