A process-level analysis of private browsing behavior: A focus on Google Chromes Incognito mode

With an increasing demand for online privacy, most mainstream Internet browsing applications now offer a service to prevent the local storage of browsing metadata. Termed `private browsing', this functionality has attracted much attention, both from the media and academic scientific research communities. The effectiveness of these privacy services has been frequently examined by digital forensic evaluative studies, revealing varying degrees of `privacy leaks' and even now, after over 10 years of development, reports reveal apparent weaknesses in some services of this type. This article presents a process-level examination to establish what is occurring on a local system during a private browsing session, with a focus on Chrome's Incognito mode. Interactions associated with Incognito mode's system process are identified to demonstrate how Chrome's Incognito mode browser window interacts with the operating system and where local-disk-writes are occurring.