Alternative browsers pose challenge for cybersleuths

Cnet News ^ | August 31, 2005 | Joris Evers

[Panerai]

The advent of Firefox and other Web browser alternatives to Internet Explorer means cybercops have to learn new tricks for their investigations.

Internet Explorer hides nothing from cops and other investigators who examine PCs to discover which sites the user has visited. They know the location of the IE browser cache, cookie files and history and know how to read those files. Also, popular forensics tools can help out.

But that story changes when it comes to alternative browsers such as Firefox and Opera. These programs use different structures, files and naming conventions for the data investigators are after and files are in a different location on the hard drive, which can cause trouble for examiners. Furthermore, forensics software may not support the Web browsers.

Though Microsoft's IE remains the most widely used browser, these alternatives are gaining in popularity. The open-source Firefox browser in particular has been able to nibble at Microsoft's dominant share of the market. Web browser data can be important in criminal investigations because browsers keep track of a suspect's online activity.

One specific challenge with Firefox and Opera is identifying which Web addresses have been entered manually as opposed to clicked on in a hyperlink, Glenn Lewis said Wednesday in a well-attended training session on alternative browsers at the annual High Tech Crime Investigation Association event here.

The distinction may be important in a case where a suspect claims he did not intend to visit a Web site, but accidentally clicked on a link or was sent to a site automatically. It is hard to argue that if an address was physically typed into the Web browser.

[Panerai]

Score another one for Firefox.

[coconutt2000]

I don't know how good Apple's Safari browser's "Private Browsing" mode is.

[Jaysun]

What's the value in such a feature if you're not a pedophile or the like?

[KneelBeforeZod]

firefox will prefetch if teamed with google. they leave this on by default...so you can have "bad" files/pix on your HD and not even know it

[Panerai]

Stiuped question, but where is that option on private browsing in Safari preferances ?

[Panerai]

Let's suppose that someone has access to your computer through a trojan horse.

[Jaysun]

Hey, how's the Cobra Kai dojo thing going? I'm looking for someone to open combo car washes with me. The Sushi deli/ shoe repair guys backed out on me, so maybe we could open Cobra Kai Car washes. Put one in front of every Starbucks.

[coconutt2000]

In the Safari menu right under the option for blocking pop up windows.

I should say that it is Safari 2.0, on OS X Tiger.

[Jaysun]

Let's suppose that someone has access to your computer through a trojan horse.

I see. That would be bad, my having to explain all of the midget porn sites and what not. No, I see what you're saying. I was under the impression that they were only talking about physically searching the hard drives.

[tomakaze]

reWhat's the value in such a feature if you're not a pedophile or the like?
 
How about basic privacy?

[Panerai]

Thanks, that explains why I did not see it, still using 10.3.9

[coconutt2000]

[coconutt2000]

No problem. I thought that might be the case for you. I should've indicated the version number.

[Jaysun]

How about basic privacy?

From whom?

[Panerai]

Just love the ease with which screen caps can be done under OS X, I do it all the time to save info.

[Prince Charles]

But cookies will still execute in Private Browsing if you go to their defining web page.

So manually clean 'em out from time to time. ;-)

[coconutt2000]

True, but I borrowed that screen capture from someone's blog. :-) Easier than doing my own and uploading it to a web server. :-)

[SoDak]

How about from a Hitlery Administration?

[tomakaze]

RE: From whom?
 
government snoops, who else?

[Hank Rearden]

What's the value in such a feature if you're not a pedophile or the like?

What's the value of a sealed envelope for private correspondence, instead of a postcard? I mean, only pedophiles would use envelopes, because you have nothing to hide. Right?