3 ms·

You Can Be Prosecuted for Clearing Your Browser History

16 points by denzil_correa 11y ago

xyzzy123 11y ago
So the thing is that when people do computer forensics, anti-forensics actions stand out clear as day on the machine and it does come up in a lot of cases. If you have some activity on a windows machine you want to hide, your best course of action is really to destroy the drive. I think the feds essentially want to be able to "use" evidence of anti-forensics in court. This is actually reasonable, but the legal theory they're trying to do that with doesn't seem very suitable. While genuine signs of anti-forensics should be admissible as evidence, it's hard to see how "destroying records" on a private computer (not for business use / at work) should be an actual crime, in and of itself. Also, "clearing browser history" as anti-forensics is seriously a reach. I do wonder if there were other actions taken (over and above clearing browser history) that weren't mentioned in the article.
scintill76 11y ago
Time to disable browser history altogether? Is storing things like that on a ramdisk considered destroying evidence when you power down? Part of David Kernell's charge was defragmenting his hard drive! Seems a stretch since it's a legitimate maintenance task, or was more commonly useful in 2008. Hopefully they gave a decent argument that it was done with intent, and didn't just bamboozle the jury. Considering that every second a computer is on, it's potentially losing forensic data, I guess they just want you to call the police immediately after doing anything on your computer that may have been illegal. But it's not self-incrimination! It's also interesting that in that case, they caught a break in the form of malware that happened to log Kernell's activity.[1] It was "designed to collect a lot of different data (including) banking and finance data" -- but somehow I have a feeling they didn't lift a finger to prosecute that crime. Maybe they would if it embarrassed a Presidential candidate. [1] http://www.knoxnews.com/news/local-news/fbi-kernell-tried-to-destroy-proof-of-e-mail http://www.knoxnews.com/news/local-news/fbi-kernell-tried-to...

16 points by denzil_correa 11y ago

So the thing is that when people do computer forensics, anti-forensics actions stand out clear as day on the machine and it does come up in a lot of cases. If you have some activity on a windows machine you want to hide, your best course of action is really to destroy the drive. I think the feds essentially want to be able to "use" evidence of anti-forensics in court. This is actually reasonable, but the legal theory they're trying to do that with doesn't seem very suitable. While genuine signs of anti-forensics should be admissible as evidence, it's hard to see how "destroying records" on a private computer (not for business use / at work) should be an actual crime, in and of itself. Also, "clearing browser history" as anti-forensics is seriously a reach. I do wonder if there were other actions taken (over and above clearing browser history) that weren't mentioned in the article.

scintill76 11y ago

Time to disable browser history altogether? Is storing things like that on a ramdisk considered destroying evidence when you power down? Part of David Kernell's charge was defragmenting his hard drive! Seems a stretch since it's a legitimate maintenance task, or was more commonly useful in 2008. Hopefully they gave a decent argument that it was done with intent, and didn't just bamboozle the jury. Considering that every second a computer is on, it's potentially losing forensic data, I guess they just want you to call the police immediately after doing anything on your computer that may have been illegal. But it's not self-incrimination! It's also interesting that in that case, they caught a break in the form of malware that happened to log Kernell's activity.[1] It was "designed to collect a lot of different data (including) banking and finance data" -- but somehow I have a feeling they didn't lift a finger to prosecute that crime. Maybe they would if it embarrassed a Presidential candidate. [1] http://www.knoxnews.com/news/local-news/fbi-kernell-tried-to-destroy-proof-of-e-mail http://www.knoxnews.com/news/local-news/fbi-kernell-tried-to...