The example above shows internet history that was stored in a file other than the main database, which represented webpages that were opened in various tabs.

Tabs are another location, in addition to downloads and bookmarks, where you will begin to notice evidence of websites visited in private browsing or incognito mode that are not stored anywhere else on the device. In addition to finding a site that was opened in private browsing mode through the tabs.archive file for this particular browser, reviewing the application snapshots, taken by the application when minimized or interrupted, further supports the evidence that the site was visited.

For tabs, it is important to note that sometimes the timing of the acquisition in relation to the search action will dictate whether or not tab-related data is available in the mobile device image.