Forensic Analysis of Tor Browser: A Case Study for Privacy and Anonymity on the Web. (June 2019)

• Record Type: Journal Article
• Authors: Jadoon, Abid Khan; Iqbal, Waseem; Amjad, Muhammad Faisal; Afzal, Hammad; Bangash, Yawar Abbas
• Is Part Of: Forensic science international. Volume 299(2019)
• Page Start: 59
• Page End: 73
• Publication Date: 2019-06
• Subjects: Web browser forensics -- Private BROWSING -- Tor -- Onion routing -- Anonymity; Medical jurisprudence -- Periodicals; Chemistry, Forensic -- Periodicals; Forensic Medicine -- Periodicals; Médecine légale -- Périodiques; Chimie légale -- Périodiques; Gerechtelijke geneeskunde; Gerechtelijke chemie; Gerechtelijke psychiatrie; Chemistry, Forensic; Medical jurisprudence; Electronic journals; Periodicals; Electronic journals; 614.1
• DOI: 10.1016/j.forsciint.2019.03.030
• Languages: English
• ISSNs: 0379-0738

Abstract

Highlights: Tor browser important artifacts from memory are collected. Tor network relay information are gathered, from memory and hard disk. Email content from memory is recovered, breaching the user privacy. Three keys are recovered from registry when Tor browser is uninstalled. Open source and demo version tools can be used for collecting evidence Abstract: Web browsers are among the most commonly used applications to access the web from any platform nowadays. With recent digital incidents involving breach of data, users are becoming more cognizant of the threat posed by malicious actors having access to personal data as well as vulnerable applications which may compromise their data. For this very reason, users are being offered privacy preserving solutions for trust maturity. The onion router (Tor) browser is one such application which not only ensures the privacy preservation goals but also provides promising anonymity. Due to this feature, majority of the users use Tor browser for normal use as well as malign activities. In order to validate the claims of Tor browser and help digital forensic investigators and researchers, we created different scenarios to forensically analyze the Tor browser privacy and anonymity. As a result of the findings, it can be concluded that the Tor browser leaves plethora of sensitive digital artifacts on host machine, which can be further used to compromise user data.