The challenge of identifying historic ‘private browsing’ sessions on suspect devices

Those subject to supervision orders requiring the lawful regulation of their Internet activity provide an investigatory challenge to law enforcement practitioners. Where a defendant's Internet history must be retained and made accessible for review at defined intervals, investigators must apply principles of digital triage to quickly evaluate existing content in order to identify any potential breaching activity. Such processes are often undertaken ‘on-scene’ and under time constraints. Whilst in some cases detecting offending actions may be simple, particularly if illegal history records are retained, it may be the case that some techniques such as private browsing functions leave minimal trace of usage post-event. As a result, live monitoring and activity capture may provide the only viable solution with regards to the effective regulation of Internet usage for those under supervision. This work examines the use of AppLocker and a bespoke developed solution ‘Private-Spy’ for the purpose of private browsing session detection. Both solutions are evaluated and findings are offered.