How much internet evidence in real terms?

How much is 50mb of internet history for this typical user?

Obviously it depends on the amount of p0rn and lolcats typically downloaded, the formula generally accepted to calculate the global amount of cache, history and cookies is
k*t*(e^2/Pi *100*1024+ a*p0rn/13000+b*lolcats/85+c*nsites*3647)

Where t is expressed in tithis
https://en.wikipedia.org/wiki/Tithi
and k is the kache constant, usually approximated to 8192/785.

Since a tithi can be anything between 19 and 26 hours the result can only be approximate, 2 hours per day are roughly 0.1 tithis, so, example of calculation, with typical values
a=3/7
b=1/7
c=3/7
p0rn= 1 Gb
lolcats=10 Mb
nsites=1200 <- number of sites viewable in a full tithi

gives 2,263,984 bytes, so 50*1024*1024/2,263,984=~ 23,158 days

Considering the volatility of some variables in the formula means in real terms *anything between 1 and 2 fortnights* or *almost, but not quite, a full synodic month*

jaclaz

*round of applause*

you have faaaar to much time on your hands P

you have faaaar to much time on your hands P

Naah, only the typical amount of it wink , though I do use an extraordinary fast browser (and like a lot non-standard units of measure, as they usually better represent real terms).

jaclaz

Ok………

I was just looking to hear from people who had examined Internet evidence on used devices, how far back does it or is it capable of covering? Weeks, months, years?

I'm just asking a question, not looking to start a forum war.

I'm just asking a question, not looking to start a forum war.

Sure ) , and I was just trying to make you aware that the question cannot have any meaningful answer because is too vague, there is no "typical" browser nor a "typical" browsing pattern.

The answer "more than days, less than years" is most probably as accurate as possible, does this help you in any way?

Your question equates to
how many km per liter will a typical vehicle do?
More than 1 less than 30.

jaclaz

I understand. That's why I was trying to use an example of a user who browses two hours per day, with an Internet memory size of 50 mb.

You saying less than a year is a little helpful, but let me put it another way for any examiners - if you take ten cases at random what would be the most common period Internet evidence covers? There must be a period more common than others, would you most often be looking at weeks or months?

Well as I see it, you are still describing a purely theoretical situation.

Not every browser (nor OS) has a provision to limit the amount of storage dedicated to history, cache and cookies, and even if it has such a provision, it is not common AFAIK that it is used in "real world" on "common cases", and there are no "common cases".

The browsing habits (and settings) of a corporate user involved in a copyright issue or industrial spying will be very different from those of a housewife involved in (say) the killing of her husband, traces found in the smartphone or laptop of a suspected drug dealer will be extremely different from those found in the desktop of a suspected pedophile, contents of a device belonging to a kid involved in cyberbullying will be very different from those of a device from someone accused of fraud, etc.

When you examine a system you try to get whatever traces you can find, and they can well (in theory) go back years, they usually don't because the device is not years old or the OS has been reinstalled to it more recently after reformatting or a "major" version of the browser has been deployed uninstalling the old version and purging the cache, or *any* among the various optimizing/cleaning tools has been run not so long ago.

To give you an example I *never* reinstall and this system was put in operation in 2008.

I use primarily Opera as a browser, so it's cache doesn't count as from time to tiime I clear it/maintain it, but in my IEcache (which I rarely use) I can find a set of files from a Bing search 😯 I performed in October 2013, and in Firefox's cache (which I also rarely use) many files date as back as January 2014 (i.e. from the very first day I installed Firefox the first time), the cache folder is around 55 Mb in size, the places.sqlite is around 10 Mb and cookies.sqlite is around 512 kb.

The dates covered in the Firefox cache are around 7 months, but since I didn't use it daily for 2 hours but rather *when needed* while these data confirm that 50 Mb worth of cache+history+cookies cover "more than weeks, less than years", the range could be possibly narrowed to 2 or 3 months.

jaclaz