Influence of HTTP Header Entries on the Forensic Analysis of Web Browser Artifacts

Abstract

The traces (digital evidence) created by users can be influenced by the parameters transmitted by the web server. HTTP header entries instruct the web browser or web server to perform certain functions. These include, for example, the criteria according to which content is to be cached on the client. If these effects are unknown to the investigators, this can be erroneously classified as manipulation. In addition, it is now being considered that new traces can be created by header entries that are not yet in the focus of the common investigation procedures. In this work, a demo application was used to investigate which parameters have an influence on the forensic investigation of traces of Mozilla Firefox.