±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36212
New Yesterday: 2 Visitors: 185

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Google History Forensics

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 

Site Admin

Google History Forensics

Post Posted: Aug 22, 11 00:45

Google History Forensics

by Craig Ball

In my last Forensic Focus column, I touched on migration to handhelds and the cloud, mushrooming drive capacities and encryption-by-default as just some of the factors auguring the eventual extinction of conventional digital forensics. But an end to old school digital forensics is no threat to examiners who evolve. There will be plenty to do for those adapting their skills and tools to new sources and forms of information. We will learn to read new tea leaves.

Happily, for every source of forensically-rich information that fades away, others emerge. For every MacBook configured to wipe deleted data, there’s an iPhone storing screenshots and typed text. When webmail shooed away some of our ability to locate messaging artifacts, social networking and geolocation wandered in with stories to tell.

Now and then, the emergent sources just seem too good to be true.

Case in point: Google History...

Read more

Please use this thread for discussion of Craig's latest column.
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus 


Re: Google History Forensics

Post Posted: Aug 22, 11 19:11

Good article - note also that your searches on other devices (eg smartphone) will be saved too, once you're logged in to your Google account at the time!  

Senior Member

Re: Google History Forensics

Post Posted: Aug 24, 11 07:08

Great information, but I'm curious about how many folks actually sign up for Google Web History. I don't recall receiving an "invitation" over the course of my Google searches. I also wonder whether there's an artifact on the local system that would reveal whether your user activated this feature. If so, I would think that we could issue a preservation letter and ultimately a warrant to get the information.  

Senior Member

Re: Google History Forensics

Post Posted: Aug 24, 11 10:05

The interesting part of google history is that average users still don't know about it. For example, when you sign up into your youtube account(and you have a google account), you'll automatically activate your google history feature.

Great article  

Senior Member

Re: Google History Forensics

Post Posted: Aug 24, 11 18:38

Here is the link to delete Google web history:

Would be an interesting URL to look out for on a review/exam and to see if it was used post preservation notice.  


Re: Google History Forensics

Post Posted: Nov 11, 11 17:27

Just had sight of this interesting article and had a play with checking out my history using Mozilla browser. Shocked

I also have Google Chrome and note that this function is available from the browser as standard after login (spanner icon top left).
opens similar page: history/



Re: Google History Forensics

Post Posted: Nov 16, 11 07:15

There will be two notable hurdles to the proliferation of cloud services. 1) local/state/fed laws will need to keep pace with the changing landscape, meaning they need to address existing laws that typically apply to a local “thing” seized by court order (warrant, subpoena, etc). Such laws will need to have “reach” just as data now has “reach” facilitated by these new cloud-type services. So perhaps when a computer or PDA is seized by warrant or subpoena such seizure extends to all “reach” aspects of the device, such as all Google or Yahoo accounts found on the computer, all twit/twot/book/flick accounts, etc. This changes the legal aspects that such services have to deal with, but so be it. However, to counter the law efforts, the “good” bad guys know how to skate in a dark park making it very difficult for forensics to find much evidence, or at minimum make it so the dots cannot be connected without seemingly ridiculous speculation.

Anyone take a gander at the new Amazon Kindle Fire and how it integrates with the Amazon Cloud? The device doesn't even have a SD card slot so in essence it will coax the owner into using the Cloud because it is "free".

IMHO, clouds are highly "unknown" and will present many challenges from the security side, including forensics. I suspect the progression of laws changing will be the norm, something bad has to happen 1st, then we get new law, etc. Nature of the beast I guess.  

Page 1 of 2
Page 1, 2  Next