Analyzing Tor Browser Artifacts for Enhanced Web Forensics, Anonymity, Cybersecurity, and Privacy in Windows-Based Systems

Analyzing Tor Browser Artifacts for Enhanced Web Forensics, Anonymity, Cybersecurity, and Privacy in Windows-Based Systems

Blog Article

The Tor browser is widely used Tough 1 for anonymity, providing layered encryption for enhanced privacy.Besides its positive uses, it is also popular among cybercriminals for illegal activities such as trafficking, smuggling, betting, and illicit trade.There is a need for Tor Browser forensics to identify its use in unlawful activities and explore its consequences.This research analyzes artifacts generated by Tor on Windows-based systems.The methodology integrates forensic techniques into incident responses per NIST SP (800-86), exploring areas such as registry, storage, network, and memory using tools like bulk-extractor, autopsy, and regshot.

We propose an automated PowerShell script that detects Tor usage and Garlic Press retrieves artifacts with minimal user interaction.Finally, this research performs timeline analysis and artifact correlation for a contextual understanding of event sequences in memory and network domains, ultimately contributing to improved incident response and accountability.