Experiment 6: browser privacy mode

Much has been discussed over the last few years about on-line privacy, and the major browser suppliers have taken notice. The main goal of browsing privacy centers around not storing browser data such as history, search terms, and passwords. Of course, no browser can control what someone else’s web server can store about a person’s behavior, but this is a step in the right direction.

Method

Using the privacy mode of the browser in question, open Google and search for a unique search string, one that is not already written to the hard drive partition. Close the browser, then search for the string on the drive using a partition editor. If the editor does not find the search string, the browser passes the privacy test. If it does find the string, the browser’s privacy mode is probably limited to protecting data viewable within the browser (but not to a forensics examiner).

Results: Microsoft Internet Explorer

Fig. 6.1. Partition search result from IE’s InPrivate mode.

Using IE 9’s “InPrivate” mode (accessible via Tools -> Safety -> InPrivate Browsing), performed a search for “privateiesearchstring.” In one test, the string appeared in a temporary file starting at sector 397880. The InPrivate feature claims to “prevent Internet Explorer from storing data about your browsing session.” [IE1] However, after closing all IE windows (thereby resetting it to standard browsing mode), the search term appeared along with the logged in user and the web site used in sector 25528 (Fig. 6.1), as well as the above file.

Results: Firefox (for Windows)

Using Firefox’s “Private Browsing" mode (Firefox -> Start Private Browsing), searched for “privateffsearchstring.” Firefox’s Private Browsing feature claims it “won’t keep any browser history, search history, download history, web form history, cookies, or temporary internet files.” [FF1] Testing this, the partition editor indeed did not find the search string. When repeating the experiment with Private Browsing mode off, the search string was written to disc. Firefox does what it claims.

Results: Google Chrome (for Windows)

Using Chrome’s “Incognito” mode (Wrench button -> New Incognito Window), searched for “privategcsearchstring.” Chrome claims its Incognito mode “won’t leave ... traces, like cookies, on your computer after you close the incognito window.” [GC1] The partition editor did not find the search string in this case, either. Chrome passes the privacy test.

Results: Apple Safari (for Windows)

Using Safari’s “Private Browsing” mode (Gear button -> Private Browsing), searched for “privatesafsearchstring.” Safari claims its Private Browsing mode “doesn’t remember the pages you visit....” [AS1] The partition editor did not find the search string in this case either, showing that Safari also delivers what it promises.