Web Browser Forensics for Retrieving Searched Keywords on the Internet

Nowadays, most of the reported cybercrimes use the Internet. It is seen that Web Browsers leave forensically sound footprints of Internet browsing activities on the computer’s storage media. The traces once retrieved stand as crucial hints that help the investigator to reconstruct various events that the suspect has done. However, the usage of private or portable web browsers prevents the creation of those files on the Suspect’s Computer. This makes the job of investigators more challenging. But, the remnants of browsing activities done using any web browser is recorded in the Physical Memory of the Computer. Hence, analyzing the Physical Memory Dump of the suspect's machine, collected as part of Live Forensics, may provide lots of forensically sound evidence related to the Internet-related activities in a cybercrime investigation. This information provides highly crucial information which can render hints in the investigation process. One of the most important features of any Cyber Forensics Analysis Tool is keyword searching. But identifying and finalizing the keywords to be searched during the analysis process in a particular Cyber Crime is always challenging for the investigators. The task of retrieving searched keywords is crucial as it directly provides the criminal background of the Suspect if any. This information enables cyber forensics investigators to conduct a focused approach while analyzing the evidence. This paper mainly presents a novel methodology for the reconstruction of searched keywords from the Physical Memory Dump collected from the Suspect’s Windows 10 Computers. A methodology for retrieving keywords from the browser files generated by Web Browsers in the storage media has also been described. The keywords retrieved in this way helps the Investigators to identify the associated highly crucial information during the deep-dive analysis of the storage media in Offline Forensic Analysis.