following message appears when we turn on private browsing in safari
"When private browsing is turned on, webpages are not added to the history, items are automatically removed from the Downloads window, information isn't saved for AutoFill (including names and passwords), and searches are not added to the pop-up menu in the Google search box. Until you close the window, you can still click the Back and Forward buttons to return to webpages you have opened."
If some one uses this kind of browsing is it a kind of antiforensic technique?
I am new to Mac environment… any input from members.
This doesn't sound like an anti-forensic measure so much as an "internet cafe" feature.
The best way to check what's going on (which I will do when I get a moment and can find the option you're talking about) is to restart the computer, change the system date or time then start Safari, browse to a site with a log-in (such as a web mail site like Yahoo!) then do a search-by-date with the system search to flag up any files that have changed. Bear in mind that all of these supposedly "disabled" features are all front end anyway - that is, the user can do all of these things for themselves through the menus - so I suspect that Safari is still logging everything behind the scenes )
Hope that helps,
Neil