Clear Browser Artifacts

A subject clears Google Chrome browser artifacts to hide evidence of their activities, such as visited websites, cache, cookies, and download history.

A subject clears Microsoft Edge browser artifacts to hide evidence of their activities, such as visited websites, cache, cookies, and download history.

A subject clears Mozzila Firefox browser artifacts to hide evidence of their activities, such as visited websites, cache, cookies, and download history.

A subject clears Apple Safari browser artifacts to conceal websites visited, files downloaded, searches performed, authenticated sessions, or other browser-based activity. The subject may clear browsing history for a selected period, remove cookies, cache, and other website data, clear download records, or directly delete or alter locally stored Safari data.

Where Safari synchronization is enabled, clearing browsing history may also remove synchronized history from other Apple devices associated with the account. Investigators should examine macOS file-system activity, browser database metadata, endpoint telemetry, and independently retained web records to identify deletion, truncation, or recreation of Safari artifacts. Local evidence should be compared with web proxy, Domain Name System (DNS), authentication, and cloud-service logs.