Additionally, several TOR browsers were examined. TOR browsers not only provide anonymity for the user when searching, they also do a better job of keeping browsing truly private by not storing it in a database or related files.

Both Orbot and Orfox were examined on a rooted Android device. While Orfox (pictured above) did show the presence of searches conducted in regular mode, the private searches were not included in tabs or cookies, which was expected. One private mode search artifact that did make its way to the file system was the existence of the name of one cached image, although the image itself did not save correctly to the cached folder. It is interesting to note all of the tables in the database that remain empty even though searches were conducted in regular mode as well as private mode, so in essence very little search history is retained.

TOR browser, the only official mobile browser supported by the Tor Project, was tested and it did not store any data related to tabs, even in a regular search mode. The only items that were retained were those bookmarked by the user.

As with any application you are examining for the first time, create test data to verify your findings.

In the screenshots below for TOR Browser for Android, you can see that only those pages that were bookmarked by the user were recorded in this application. There was no reference to any tabs that were open prior to the acquisition.