Title: Web browser forensics: Mozilla Firefox

Authors: Hitesh Sanghvi; Digvijaysinh Rathod; Parag Shukla; Ramya Shah; Yashrajsinh Zala

Addresses: Directorate of Forensic Science, Gujarat, India ' School of Cyber Security and Digital Forensics, National Forensic Sciences University, Gandhinagar, India ' School of Cyber Security and Digital Forensics, National Forensic Sciences University, Gandhinagar, India ' School of Cyber Security and Digital Forensics, National Forensic Sciences University, Gandhinagar, India ' School of Cyber Security and Digital Forensics, National Forensic Sciences University, Gandhinagar, India

Abstract: Aside from Internet Explorer, Mozilla's Firefox is one of the most established and popular web browsers. These days, Firefox allows private (Incognito) windows just like every other browser. According to Mozilla Firefox, private browsing does not save cookies or browsing history and leaves no traces behind when sessions are ended. If offenders commit crimes while using private browsing, this will present a barrier to digital forensic analysis because there would not be any computer-based evidence. While Mozilla Firefox was open in both normal and private modes, we conducted an in-depth investigation to assess the status of the evidence. In the experiment, the activities were carried out in one virtual machine in regular mode and another in a private Firefox window. Later, we carried out forensic acquisition of the RAM and hard drive and evaluated what kinds of evidence were discovered from both VMs. The tools FTK and Autopsy were used to analyse the collected data. We found the important evidence of various activities obtained related to Google, YouTube, Twitter, Amazon, Facebook, Outlook, Yahoo and Gmail using FTK and Autopsy through the hard disk and RAM forensics while Firefox opened in normal and private mode. We can also determine from this result that FTK carves more data from the image file than autopsy.

Keywords: Mozilla Firefox; FTK; autopsy; RAM forensics; HDD forensics; private browsing; digital forensics.

DOI: 10.1504/IJESDF.2024.139645

International Journal of Electronic Security and Digital Forensics, 2024 Vol.16 No.4, pp.397 - 423

Received: 30 Dec 2022
Accepted: 27 Feb 2023
Published online: 05 Jul 2024 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article