Skip to main content

Research Repository

Advanced Search

Browsers’ Private Mode: Is It What We Were Promised?

Hughes, Kris; Papadopoulos, Pavlos; Pitropakis, Nikolaos; Smales, Adrian; Ahmad, Jawad; Buchanan, William J.


Kris Hughes

Adrian Smales


Web browsers are one of the most used applications on every computational device in our days. Hence, they play a pivotal role in any forensic investigation and help determine if nefarious or suspicious activity has occurred on that device. Our study investigates the usage of private mode and browsing artefacts within four prevalent web browsers and is focused on analyzing both hard disk and random access memory. Forensic analysis on the target device showed that using private mode matched each of the web browser vendors’ claims, such as that browsing activity, search history, cookies and temporary files that are not saved in the device’s hard disks. However, in volatile memory analysis, a majority of artefacts within the test cases were retrieved. Hence, a malicious actor performing a similar approach could potentially retrieve sensitive information left behind on the device without the user’s consent.

Journal Article Type Article
Acceptance Date Nov 26, 2021
Online Publication Date Dec 2, 2021
Publication Date 2021
Deposit Date Jan 13, 2022
Publicly Available Date Jan 13, 2022
Journal Computers
Publisher MDPI
Peer Reviewed Peer Reviewed
Volume 10
Issue 12
Article Number 165
Keywords digital forensic investigation; web browsers; private mode; artefacts
Public URL


You might also like

Downloadable Citations