數位鑑識之無痕瀏覽器證據調查研究

Private Browsing Evidence of Google History Investigations in Computer Forensics

柯博淞(Bong-Sung Ke) ； 林曾祥(Jsen-Shung Lin) ； 王旭正(Shiuh-Jeng Wang) ； 左豪官(Hao-Kuan Tso)

《電子商務學報》 16卷1期 (2014/03) Pp. 85-105

https://doi.org/10.6188/JEB.2014.16(1).04

摘要

鑑識人員若要還原網路犯罪，網頁紀錄是重要的關鍵跡證。但近年設計出安全性較高的無痕瀏覽（private browsing），它讓我們在瀏覽網頁後能夠不留下痕跡，將網頁紀錄刪除。所以當鑑識人員面對無痕瀏覽時，是否還有機會萃取出網頁相關的紀錄，證實犯罪的真假。因此本篇文章提供了使用無痕瀏覽後，我們還能夠在使用者的電腦裡詳細分析網頁紀錄及在Google History（搜尋紀錄）紀錄搜尋過的關鍵字和網頁，並且也比較了無痕瀏覽與一般瀏覽刪除網頁紀錄的情形。透過我們的實驗結果可以發現遭到刪除的網頁紀錄可以使用我們提出的方法萃取出來及解釋無痕瀏覽的實現方法，我們所提供的方法可以讓鑑識人員面對無痕瀏覽的非法活動時，能夠萃取網頁紀錄並將犯人繩之以法。

關鍵字

數位證據 ； 數位鑑識 ； 瀏覽器 ； 無痕瀏覽 ； 網頁紀錄

並列摘要

The evidence investigations on the internet, the records left in the web-site are rather critical points to unveil the truth for the investigators. With the fast progress of the high-tech on the internet applications, the choice of the private browsing model is to offer higher security when visiting the relative web-sites. It enables the evidence to get rid of recording in the computer systems so as to guarantee the user privacy in personal data usages. But the evidence is still required to extract whenever the crime-event occurs on the internet with committing the illegal activities. In this paper, we propose the observations in the Google history to keep track of the relative evidence to unveil the truth so as to support the investigations in the crime-event on the internet. It turns out that the deleted web-pages and relative records could be found out although the private browsing model is applied on visiting the internet. By the way, the extracted evidence in the forensic report could clearlyindicate the illegal activities to guarantee the commitment for a suspect.

並列關鍵字

Digital evidence ； forensics ； browser ； private browsing ； web-page record

參考文獻

吳清、吳順祥（2008）。index.dat 文件結構解析。現代計算機，(297)，4-7。

Aggarwal, G., Bursztein, E., Jackson, C., & Boneh, D. (2010). An analysis of private browsing modes in modern browsers. Proceedings of the 19th USENIX Conference on Security, CA, USA.

Castelluccia, C., Cristofaro, E. D., & Perito, D. (2010). Private information disclosure from web searches. Proceedings of the 10th International Conference on Privacy Enhancing Technologies, Berlin, Germany.

Choi, J. H., Lee, K. G., Park, J., Lee, C., & Lee, S. (2012). Analysis framework to detect artifacts of portable web browser. In Park, J. J., Kim, J., Zou, D., & Lee, Y. S. (Eds.), Information technology convergence, secure and trust computing, and data management: Lecture notes in electrical engineering 180 (207-214). Heidelberg, Germany: Springer.

Chu, H. C., Deng, D. J., & Park, J. H. (2011). Live data mining concerning social networking forensics based on a Facebook session through aggregation of social data. IEEE Journal on Selected Areas in Communications, 29(7), 1368-1376.