Identifying Additional Devices and Accounts
Chrome may provide even more information than some other browsers due to robust synchronization between devices. The popularity of Chrome and the ubiquity of Google accounts means that access to one device can provide substantial information about other devices and accounts. For example, an examiner analyzing a laptop may review the Chrome synchronization data and learn that the subject of the investigation also used a cellphone or a second computer, which might lead to the collection of additional evidence.
Incognito Mode and Forensic Examination
Chrome has a well-known feature called “Incognito Mode” which allows users to browse the internet with a greater amount of privacy. When browsing in Incognito Mode, Chrome does not retain a history of websites, downloads, or cookies. However, this information is still stored temporarily, mainly in RAM, and therefore can be recovered in some circumstances, particularly if the device has not been powered off. Even in Incognito Mode, using Chrome leaves plenty of traces, and some data regarding the user’s activities will persist on the device for a long time. An experienced examiner can use forensic tools to extract and interpret this data.