메모리 포렌식 관점에서의 모바일 브라우저 사생활 보호 모드 분석

The function that allows not to store data of actions taken in web browsers is called privacy mode, and is supported by most web browsers. This function is provided to protect user’s privacy, and since it does not store web activity it can be used as an anti-forensics method to protect from tracking users behavior in web browsers. However, there are no existing researches analyzed from a forensics perspective on the privacy mode of mobile web browsers. Thus, in this paper, four mobile web browsers were selected to conduct memory forensics of the privacy mode to obtain data that can determine user’s behavior. The experiment was conducted by analyzing the URL of the searched sites according to the search engine and extracting keywords to find searched terms and visited sites. In addition, it was analyzed whether the file was downloaded or not, and if it was, we were able to extract path to the file. The web browser traces analyzed in this study can be used in digital forensics to help identify user behavior.