Making the most out of cookies for better web evidence

The role of e-Discovery in anti-corruption cases
June 14, 2012
Using GPS Devices in Forensic Investigations
June 28, 2012
Show all

Making the most out of cookies for better web evidence

Most people have probably heard that they have “cookies” on their computers, but few people really know what they are or what they do.  But even those who are familiar with the privacy aspects of cookies may not know that these little information files can be valuable tools in the hand of a seasoned private investigator.

How is Web Evidence Extracted?

Web browsers store cookies as you search the Internet. These cookies are filled with information about your browsing history and Internet usage. They can be analyzed to produce web evidence or information that can establish a larger picture of activities executed within its system.

Web evidence may also be extracted from:

  • Hard drives
  • Smart phones
  • Mobile devices
  • Any other device which has been connected to the Internet

Web evidence is helpful due to its flexibility and relatively easy methods of procurement. In many cases, web evidence can provide support to broader cases and can help in any number of situations as supporting evidence.  This type of data may be able to help:

  1. Prove a person’s location at a given time or place
  2. Prove a person’s access to information online
  3. Provide supporting evidence in cases
  4. Further validate or give context to other evidence or information

Tools for recovering web evidence

Google utilizes free software called Google Analytics in which users can use their own data to help improve their websites. Data, or cookies, is collected by Google and can help users define from where, for how often and by which methods a user interacted with a site.

Another tool is developed by CCL-Forensics called “dunk!”, a software utility which parses these cookie files and presents the investigator with the data contained within.

These are just a few of the tools available for investigators to obtain and analyze web based data.  These tools make it possible to collect the maximum amount of evidence in any investigation, and provides important context for other evidence that has been collected.