Android Forensics Analysis: Is it incognito?

Forensic analysts are facing increasingly complex challenges in their examinations of digital devices due to rapid technological advancements. Designed to protect user privacy, private browsing claims to prevent the storage of local traces after a session. To test these assertions, an in-depth analysis was performed on browsing activities in the Google search engine, comparing regular and private browsing sessions. Contrary to the promise of complete privacy, the analysis uncovered specific traces of user activity, including metadata and cached elements, even after private sessions. These findings reveal critical vulnerabilities in Google’s private browsing mode, emphasizing the need for forensic analysts to stay updated on evolving search engine technologies and their potential forensic implications.