This isn't really the normal kind of forensic question I see posted here, but hopefully you guys know something about this, it seems to be pretty hard to find info on.
I guess my question is, how does adware specifically track a users browsing habits?
1. Is it logging all the "events" after the install is complete and storing them?
2. Does it/ an adware employee have the ability to dive into the file system and pull out history files? I.E you have an adware toolbar installed on Internet explorer, can it get into the webcache/index.dat files and extract them? (I realize that these files may be encrypted now, but I know they were not always like that)
3. Can it check the history in the API?
4. Have they been known to key log?
5. Can they kind of "watch" your screen, see what you see kind of thing? Like a backdoor?
I know there are many different variations of adware, but if anybody knows what kind of types have what capabilities I would love to hear about it!
Thanks