A Forensic Analysis of Android Mobile Private Browsing Artifacts

The adoption of mobile devices and functionality continues to grow daily. Simultaneously, there has been an increase in privacy awareness and the desire for anonymity while browsing the internet. This research paper aims to explore the effectiveness of private browsing at mitigating the generation and persistence of filesystem-based artifacts on Android-based mobile devices. Four popular browsers used by advocates of private browsing were studied: Chrome, Firefox, DuckDuckGo, and Tor Browser. In some cases, the results were in line with expectations. In others, the results were alarming. The research shows that gaining access to a full disk image, including unallocated disk space, could allow an individual to access private browsing history, as well as the screenshots of websites visited in specific cases. In all cases, persistent filesystem-based artifacts were generated. In summary, private browsing is not as private as popularly perceived.