web browser forensics

Free Web Browser Forensic Tools

by

SHAPE \* MERGEFORMAT

Professor Dr. Jason James

University of Cumberlands

Web Browser Forensics

03/17/2021

Web Browser Forensics Tools

Web browsers are applications used to access and view different websites. The web browsers could be used in mobile phones and desktops, among other computerized devices to access the websites. On the other hand, web browser forensic is a field of expertise where specialists use paid or unpaid tools to detect unlawful users of web browsers (Akbal et al., 2016, Jadhava and Mersham, 2018). This paper discusses the unpaid forensic browsers that include Forensic Toolkit (FTK), volatility, Disk analysis, and Wireshark

To begin with, it is the FTK. The FTK imager web browser forensic has two primary applications when performing web forensics. First, it previews data, and second, it does imaging that allows web users to quickly assess electronic evidence to find out if further forensics with other tools is needed (Poston, 2021). The FTK can develop perfect copies without changing the original image on the computers. Analysis of the image without altering its original form is advantageous. It allows experts to ascertain that there are no modifications to disc drives that could affect forensic analysis results (Jadhava and Mersham, 2018, Poston, 2021). Improvements in the speed of FTK have been one of the key developments in web Forensics. The rate of creating an image has been enhanced. This increase in speed is intended to enhance imaging and data previews so that the web browser analysis is done faster. Additionally, the FTK web browser forensics has high accuracy levels as it can create perfect copies and forensic images of computer data while maintaining the original information (Poston, 2021). The ability to ensure that original information remains unchanged enhances outcomes results because it shows no modifications have been done to the disc. In other words, if imaging provides a changed version of an image, the web browser forensic experts can resort to other tools. The original media is thus kept safe from any cyber-crime attempts. Lastly, when an entire drive is imaged, a hash is produced by the FTK imager and could be used to verify that both the image and the drive hash match after the image is created, which also proves that the image is original (Poston, 2021). To sum up, FTK does preview and imaging to verify that the image produced is original, enhancing its accuracy and integrity when used as a forensic tool.

Besides, the other free web browser forensic tool is the volatility. In forensics, relevant information could be stored in the RAM, a volatile memory (Poston, 2021). Consequently, the volatile memory is delicate, and the information it has should be collected with keenness. After the collection of the information, a forensic volatility tool is used to analyze the volatile memory. The forensic volatility tool is compatible with operating systems in windows (Poston, 2021). To that end, the forensic volatility tool is used to analyze the volatile memory information in forensics.

Also, the Wireshark is another free web browser tool that can be applied in network analysis. The tool is common in network analysis as it provides dissectors for a wide range of network traffic. The unique feature of Wireshark is that it does not focus on the endpoint during web forensics analysis. It works on the principle data cyber-attacks can occur at any point in the network and analyzes the traffic network to identify evidence of crimes (Poston, 2021). Through analysis of the network traffic, Wireshark detects malware and provides access to data that could have already been deleted on the network. Wireshark is also embedded with systems that support live traffic capture or which could ingest network capture files for analysis (Poston, 2021). The forensic tool has some unique features distinct from other tools. Among the features is the ability to conduct a deep inspection of the network every time. As mentioned, it also carries out live capture and offline analysis to determine attempts of cyber-attacks on the websites (Poston, 2021). Therefore, like other unpaid tools with unique features, Wireshark allows web browser forensic experts to capture live and offline analysis and conduct a frequent deep inspection of the website to identify unlawful users.

Lastly, there is the disk analysis free web analysis tool commonly used in web browser forensics. The disk analysis works like a command-line since it performs forensic analysis of forensic images usually found on hard drives (Poston, 2021). Disc analysis has modular and plug-in architecture allowing users to add more functionality to the tool (Poston, 2021). The tool is easy to use during an analysis of hard drives and smartphones. It is also incorporated with community-based tools such as emails and forums. Summarily, the data analysis tool conducts web browser forensics by analyzing the hard drives.

In summary, disk analysis, Wireshark, volatility, and Forensic Toolkit are among the free forensic tools used in web browser forensics. FKT is used for imaging, and disk analysis involves analyzing hard drives and smartphones; volatility is useful in RAM analysis, while Wireshark analyzes the traffic on the network.

Fig 1: Forensic Tool Kit (FTK), https://i1.wp.com/forensicstore.com/wp-content/uploads/2017/08/forensic-toolkit-ftk4-11.png?fit=500%2C500&ssl=1

Fig 2: Wireshark Forensic Tool, https://www.cybersecurityinstitute.eu/wp-content/uploads/Forensic-2-678x381.jpeg

Fig 3: Volatility Forensic Tool, https://www.osforensics.com/faqs-and-tutorials/images/volatility-command.png

Fig 4: Disk analysis Forensic Tool, http://www.techtalk.gfi.com/wp-content/uploads/2013/09/11.jpg

References

Akbal, E., Güneş, F., & Akbal, A. (2016).Digital forensic analyses of web Browser Records.Journal of Software,11(7), 631-637. doi:10.17706/jsw.11.7.631-637

Jadhav, M. R., &Meshram, B. B. (2018).Web Browser Forensics for Detecting User Activities.International Research Journal of Engineering and Technology (IRJET),5, 7, pp. 273-279.

Poston, H. (2021, January 6). Infosec, Inc.  https://resources.infosecinstitute.com/topic/7-best-computer-forensics-tools/