Browser History And Internet Artefacts

BROWSER & INTERNETARTEFACTS · AGUIDEFORUKLAWYERS Browser History and Internet Artefacts What the Browser Records, What It Means, and What It Does Not Prove COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-BROWSER ARTEFACT ANALYSIS DELETED-HISTORY RECOVERY CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a URL is not an intention 03 What the browser records, and where 04 Deliberate action versus automatic activity 05 Collecting and recovering browser artefacts 06 Interpretation, attribution and honest limits 07 Deployment: knowledge, intent, research and concealment 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: a browser records visits, searches, downloads and much more with great clarity, but a deliberate user action from automatic background activity and stating each artefact at its honest weight. § 0 2 · FIRSTPRINCIPLES The problem in plain English: a URL is not an intention § 0 3 · WHATTHEBROWSERRECORDS What the browser records, and where HISTORY SEARCHES DOWNLOADS CACHE / COOKIES ACCOUNTS / SYNC § 0 4 · ACTIONVERSUSAUTOMATION Deliberate action versus automatic activity § 0 5 · COLLECTINGANDRECOVERING Collecting and recovering browser artefacts § 0 6 · INTERPRETATIONANDHONESTLIMITS Interpretation, attribution and honest limits § 0 7 · DEPLOYMENT Deployment: knowledge, intent, research and concealment § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ACCOUNT SIGNED-IN DEVICE OS / SYSTEM NETWORK / DELETED / BROWSER ARTEFACTS DESTINATION RECOVERABLE SYNCED OTHER (CLOUD) DEVICES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEADVERTDOMAINSMISTAKENFORDELIBERATEVISITS EXAMPLE2 · THECLEAREDHISTORYTHEACCOUNTREMEMBERED EXAMPLE3 · THESHAREDCOMPUTERANDTHEWRONGPROFILE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORABROWSER - ARTE FAC TEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The browser-artefact checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Does a website in the browser history mean our client went there? Our client cleared their history. Is it gone? Can we tell who was actually using the browser? What about private or incognito browsing? Are searches stronger evidence than visits? The other side is relying on a long list of sites. How do we respond? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY