The Experts below are selected from a list of 6 Experts worldwide ranked by ideXlab platform

Howard Chivers - One of the best experts on this subject based on the ideXlab platform.

  • Private Browsing: A window of forensic opportunity
    Digital Investigation, 2014
    Co-Authors: Howard Chivers
    Abstract:

    Abstract The release of Internet Explorer 10 marks a significant change in how Browsing artifacts are stored in the Windows file system, moving away from well-understood Index.dat files to use a high performance database, the Extensible Storage Engine. Researchers have suggested that despite this change there remain forensic opportunities to recover Inprivate Browsing records from the new browser. The prospect of recovering such evidence, together with its potential forensic significance, prompts questions including where and when such evidence can be recovered, and if it is possible to prove that a recovered artefact originated from Inprivate Browsing. This paper reports the results of experiments which answer these questions, and also provides some explanation of the increasingly complex data structures used to record Internet activity from both the desktop and Windows 8 Applications. We conclude that there is a time window between the private Browsing session and the next use of the browser in which Browsing records may be carved from database log files, after which it is necessary to carve from other areas of disk. It proved possible to recover a substantial record of a user's Inprivate Browsing, and to reliably associate such records with Inprivate Browsing.

Teveldal Philip - One of the best experts on this subject based on the ideXlab platform.

  • Forensic analysis of the ESE database in Internet Explorer 10
    Högskolan i Halmstad Sektionen för Informationsvetenskap Data– och Elektroteknik (IDE), 2013
    Co-Authors: Malmström Bonnie, Teveldal Philip
    Abstract:

    With Internet Explorer 10, Microsoft changed the way of storing web related information. Instead of the old index.dat files, Internet Explorer 10 uses an ESE database called WebCacheV01.dat to maintain its web cache, history and cookies. This database contains a wealth of information that can be of great interest to a forensic investigator. This thesis explores the structure of the new database, what information it contains, how it behaves in different situations, and also shows that it is possible to recover deleted database records – even when the Inprivate Browsing mode has been used

Malmström Bonnie - One of the best experts on this subject based on the ideXlab platform.

  • Forensic analysis of the ESE database in Internet Explorer 10
    Högskolan i Halmstad Sektionen för Informationsvetenskap Data– och Elektroteknik (IDE), 2013
    Co-Authors: Malmström Bonnie, Teveldal Philip
    Abstract:

    With Internet Explorer 10, Microsoft changed the way of storing web related information. Instead of the old index.dat files, Internet Explorer 10 uses an ESE database called WebCacheV01.dat to maintain its web cache, history and cookies. This database contains a wealth of information that can be of great interest to a forensic investigator. This thesis explores the structure of the new database, what information it contains, how it behaves in different situations, and also shows that it is possible to recover deleted database records – even when the Inprivate Browsing mode has been used