Private Web Browser Forensics: A Case Study of the Epic Privacy Browser

TL;DR

This paper investigates the forensic evidence available from the Epic Privacy Browser, highlighting how its use in illegal activities can be analyzed through live and post-mortem examinations.

Contribution

It provides a detailed analysis of evidence recovery methods specific to the Epic Privacy Browser, a widely used private browser.

Findings

Evidence can be recovered from both live and post-mortem states.

The browser's operation leaves identifiable traces that aid forensic investigations.

Tools and techniques for effective evidence presentation are outlined.

Abstract

Organised crime, as well as individual criminals, is benefiting from the protection of private browsers provide to those who would carry out illegal activity, such as money laundering, drug trafficking, the online exchange of child-abuse material, etc. The protection afforded to users of the Epic Privacy Browser illustrates these benefits. This browser is currently in use in approximately 180 countries worldwide. This paper outlines the location and type of evidence available through live and post-mortem state analyses of the Epic Privacy Browser. This study identifies the manner in which the browser functions during use, where evidence can be recovered after use, as well as the tools and effective presentation of the recovered material.