A Forensic Analysis of the Tor Network in Tails Operating system

The Tor network is a widely used tool for online privacy and security, allowing users to communicate and access information anonymously. The anonymous and untraceable nature of communication and transactions on the dark web makes it challenging for Law Enforcement Agencies (LEAs) to monitor and investigate criminal activities. This study aims to perform a forensic analysis of the unencrypted layer in the Tor network to examine the extent to which network traffic analysis can reveal information about the user's online activities for criminal investigation. The methodology used in this study involves capturing and analyzing network traffic from Tor Browser running in Tails operating system, with a focus on the information transmitted in the unencrypted layer of the network. The major findings of this study indicate that it is possible to de-anonymize Tor users and determine their online activities by analyzing the unencrypted headers of their network packets. The implications of these findings are significant for LEA and cybersecurity professionals, as well as for the privacy and security of Tor users. The findings suggest that the Tor network, while a valuable tool for online privacy and security, is not without its risks and limitations, and that users must take appropriate measures to protect their privacy and security when using the network.