Browser Artifacts

• Volatile data – This data changes from session to session. Recovered data includes opened windows with positions, tabs, scroll positions, and pop-ups. The cache contains the URLs of visited websites and their related elements (e.g., images, text). The history saves all websites visited with time stamps. Logfiles record all events, stating the date, time, and event source. The session key of an https/SSL connection with a website is saved on the user system after validating the site certificate and is used for symmetric encryption.
• Less volatile data – Cookies are stored in the browser to identify a user's interests and website visits in order, for example, to show user-targeted advertising. Bookmarks are preferred URLs stored by the user in the browser. Login credentials are username-password combinations for logging in to user accounts. Autocompletion data are form data (e.g., name, address, passwords) that can be retrieved automatically and at any time after initial input.
• Downloads – The download history includes information about which files were downloaded when, and which were canceled during downloading.
• Configurations – Browser settings allow the investigator to track changes that caused vulnerabilities (e.g., the storage behavior of data).

Browser-Specific Services

The Domain Name System (DNS) is used to map IP addresses to domain names and offers the possibility of incorporating an automatic redirect to a spoofed website. The IP address – if it is not obfuscated – can reveal the user's location.

External Browser Components

A plugin is an additional program that is integrated with a host program through a predefined interface, thus extending the program's functionality. It helps process data on web pages (e.g., PDFs, Flash). Extensions, also known as add-ons, are enhancements to existing hardware or software (e.g., stock tickers, toolbars, pop-up ads).