An Evidence-Aware Framework for Cross-Artefact Windows Browser Forensic Investigation and User Activity Reconstruction

Windows browser evidence is fragmented across browsers, profiles, artefact types and operating-system sources, and isolated analysis can leave completeness, support, inconsistency and traceability unaddressed. This paper proposed an evidence-aware framework that carries evidence from acquisition and preservation, through a unified evidence model and cross-browser and cross-artefact correlation, to a forensic intelligence module, activity reconstruction and traceable reporting, without determining truth, intent, identity or authorship. Its principal contribution is the integration of these functions into a coherent, testable architecture that responds to the gaps supported by the examined evidence, and a controlled ground-truth evaluation methodology was specified. Because no implementation or empirical evaluation has been performed, effectiveness remains unproven and empirical validation is necessary.

[1]    J. Oh, S. Lee, and S. Lee, “Advanced evidence collection and analysis of web browser activity,” Digit. Investig., vol. 8, suppl., pp. S62–S70, 2011, doi: 10.1016/j.diin.2011.05.008. [2]    M. T. Pereira, “Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records,” Digit. Investig., vol. 5, no. 3–4, pp. 93–103, 2009, doi: 10.1016/j.diin.2009.01.003. [3]    B. Jeong, S. Lee, and J. Park, “MIC: Memory analysis of IndexedDB data on Chromium-based applications,” Forensic Sci. Int., Digit. Investig., vol. 50, Art. no. 301809, 2024. [4]    Google Security Blog, “Improving the security of Chrome cookies on Windows,” Jul. 30, 2024. [Online]. Available: https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html [5]    G. Aggarwal, E. Bursztein, C. Jackson, and D. Boneh, “An analysis of private browsing modes in modern browsers,” in Proc. 19th USENIX Security Symp., Washington, DC, USA, Aug. 2010. [6]    D. J. Ohana and N. Shashidhar, “Do private and portable web browsers leave incriminating evidence? A forensic analysis of residual artifacts from private and portable web browsing sessions,” EURASIP J. Inf. Secur., vol. 2013, Art. no. 6, 2013, doi: 10.1186/1687-417X-2013-6. [7]    M. Muir, P. Leimich, and W. J. Buchanan, “A forensic audit of the Tor Browser Bundle,” Digit. Investig., vol. 29, pp. 118–128, 2019, doi: 10.1016/j.diin.2019.03.009. [8]    G.-Y. Choi, J. Bang, S. Lee, and J. Park, “Chracer: Memory analysis of Chromium-based browsers,” Forensic Sci. Int., Digit. Investig., vol. 46, suppl., Art. no. 301613, 2023, doi: 10.1016/j.fsidi.2023.301613. [9]    F. Iqbal, Z. Khalid, A. Marrington, B. Shah, and P. C. K. Hung, “Forensic investigation of Google Meet for memory and browser artifacts,” Forensic Sci. Int., Digit. Investig., vol. 42, Art. no. 301448, 2022, doi: 10.1016/j.fsidi.2022.301448. [10]  K. Kent, S. Chevalier, T. Grance, and H. Dang, “Guide to integrating forensic techniques into incident response,” National Institute of Standards and Technology, Gaithersburg, MD, USA, NIST Spec. Publ. 800-86, 2006, doi: 10.6028/NIST.SP.800-86.