A forensic examination of web browser privacy-modes

Abstract Private browsing facilities are part of many mainstream Internet browsing applications and arguably, there is now more awareness of their function and purpose by the average Internet user. As a result the potential for those engaging in malicious and/or illegal browsing behaviours, to do so in a ‘privatised’ way is increased. Many private browsing modes are designed to be ‘locally private’, preventing data denoting a user’s browsing actions from being stored on their device. Such actions, potentially compromise the availability of any evidential data, provide an investigatory headache. This work documents the examination of 30 web browsers to determine the presence of a ‘private mode’, and where available, the ‘privateness’ of said mode. Our test methodology is documented and results and limitations described for the purpose of open, transparent scrutiny and evaluation from those operating in this area.