I didn't see that! An examination of internet browser cache behaviour following website visits

    Research output: Contribution to journalArticle

    190 Downloads (Pure)

    Abstract

    By default, all major web browsing applications cache visited website content to the local disk to improve browser efficiency and enhance user experience. As a result of this action, the cache provides a window of opportunity for the digital forensic practitioner to establish the nature of the content which was hosted on the websites which had been visited. Cache content is often evidential during cases surrounding Indecent Images of Children (IIoC) where it is often assumed that cached IIoC is a record of the content viewed by a defendant via their browser. However, this may not always be the case. This article investigates web browser cache behaviour in an attempt to identify whether it is possible to definitively establish what quantity of cached content was viewable by a user following a visit to a website. Both the Mozilla Firefox and Google Chrome browser caches are analysed following visits to 10 test websites in order to quantify cache behaviour. Results indicate that the volume of locally cached content differs between both web browsers and websites visited, with instances of images cached which would not have been viewable by the user upon landing on a website. Further, the number of cached images appears to be effected by how much of a website a user scrolls through.
    Original languageEnglish
    Pages (from-to)105-113
    Number of pages9
    JournalDigital Investigation
    Volume25
    Early online date2 Mar 2018
    DOIs
    Publication statusPublished - 1 Jun 2018

    Fingerprint Dive into the research topics of 'I didn't see that! An examination of internet browser cache behaviour following website visits'. Together they form a unique fingerprint.

  • Cite this