Page 1

BROWSER & INTERNETARTEFACTS · A GUIDE FOR UK LAWYERS Browser History and Internet Artefacts What the Browser Records, What It Means, and What It Does Not Prove COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-BROWSER ARTEFACT ANALYSIS DELETED-HISTORY RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a URL is not an in ten t i on 03 What the browser records, and where 04 Deliberate action versus automatic activity 05 Collecting and recovering browser artefacts 06 Interpretation, attribution and honest limits 07 Deployment: knowledge, intent, research and concealment 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: a browser records visits, searches, downloads and much more with great clarity, but a deliberate user action from automatic background activity and stating each artefact at its honest weight.

§ 02 · FIRST PRINCIPLES The problem in plain English: a URL is not an in ten t i on

§ 03 · WHATTHEBROWSERRECORDS What the browser records, and where HISTORY SEARCHES DOWNLOADS CACHE / COOKIES ACCOUNTS / SYNC