Article

A Forensic Examination of Online Search Facility URL Record Structures

Authors:
To read the full-text of this research, you can request a copy directly from the author.

Abstract

The use of search engines and associated search functions to locate content online is now common practice. As a result, a forensic examination of a suspect's online search activity can be a critical aspect in establishing whether an offense has been committed in many investigations. This article offers an analysis of online search URL structures to support law enforcement and associated digital forensics practitioners interpret acts of online searching during an investigation. Google, Bing, Yahoo!, and DuckDuckGo searching functions are examined, and key URL attribute structures and metadata have been documented. In addition, an overview of social media searching covering Twitter, Facebook, Instagram, and YouTube is offered. Results show the ability to extract embedded metadata from search engine URLs which can establish online searching behaviors and the timing of searches.

No full-text available

Request Full-text Paper PDF

To read the full-text of this research,
you can request a copy directly from the author.

... Google™, for example, uses complex algorithms that consider, amongst others, a user's previous search history and location. In contrast, Bing™, another major search engine, focuses on user interface design and provides a more visually appealing experience, especially for image and video searches [46]. In essence, search engines are in a constant state of adapting to meet the ever-changing demands and preferences of users, which will also impact search results over time. ...
Article
Full-text available
The Internet is the most used source of HIV information second to information received from healthcare professionals. The aim of this study was to assess the quality of Internet information about periodontitis in people living with HIV (PLWH). An Internet search was performed on 18 April 2024 using the search terms “Periodontitis”, “Periodontal disease”, and “Gum disease” in combination with “HIV” in the most popular search engines (Google™, Bing™, and YAHOO!®). The first 20 results from each search term engine were pooled for analysis. Quality was assessed by JAMA benchmarks. Readability was assessed using the Flesch reading ease score (FRES). Origin of the site, type of author, and information details were also recorded. The quality of Internet information about periodontitis in PLWH varied. The mean JAMA score was 2.81 (SD = 1.0). The websites were generally fairly difficult to read (mean FRES = 57.1, SD = 15.0). Most websites provided some advice about self-treatment of oral problems, accompanied by a strong recommendation to seek professional dental care. In conclusion, advanced reading skills on periodontitis in PLWH were required and quality features were mostly not provided. Therefore, healthcare professionals should be actively involved in developing high-quality information resources and direct patients to evidence-based materials on the Internet.
... In that case, forensic investigators may get evidence by observing downloaded file lists in the browser. Forensic examination of a criminal's online search activity can be submitted to the court as evidence based on extraction of embedded metadata like keywords in search and timing of search from search engine URL [22]. Either anti-forensic tools or techniques are software and techniques that make it difficult or impossible for forensic investigators to retrieve, investigate, or interpret evidence from digital devices [23]. ...
Article
This paper is a fusion of a survey of different existing research related to web forensics, disk forensics, and email forensics and the implementation of the best practices in these areas. During the survey of ongoing state-of-the-art research, we observed that every forensic investigation process goes through five phases: identification of evidence, collection of evidence, examination of evidence, assessment/investigation of evidence, and reporting of evidence. Although phases are the same in all forensics investigations, for every forensics investigation there is a specialized set of forensics tools. This paper also highlights the need for intelligent tool selection and current challenges of web forensics, disk forensics, and email forensics and infers future research trends toward solving these current challenges. Eventually, we performed various case studies of web forensics, disk forensics, and email forensics and added three interesting investigations to this paper. The change in the price of items in the shopping cart on an e-commerce website before checkout is a case study of web forensics. To obtain system files using forensic tool kit (FTK) imager is a case study of disk forensics. Show original of g-mail is a case study of email forensics.
... Horsman provides recent technical notes on various searching functions of several popular browsers, however, only two of Bing's FORM parameters are described (RESTAB and QSRE) [16]. ...
Article
Non-local forms of file storage and transfer provide investigatory concerns. Whilst mainstream cloud providers offer a well-established challenge to those involved in criminal enquiries, there are also a host of services offering non-account based ‘anonymous’ online temporary file storage and transfer. From the context of a digital forensic investigation, the practitioner examining a suspect device must detect when such services have been utilised by a user, as offending files may not be resident on local storage media. In addition, identifying the use of a service may also expose networks of illegal file distribution, supporting wider investigations into criminal activity. This work examines 16 anonymous file transfer services and identifies and interprets the digital traces left behind on a device following their use to support law enforcement investigations.
Conference Paper
Full-text available
The deliberate misuse of technical infrastructure (including the Web and social media) for cyber deviant and cybercriminal behaviour, ranging from the spreading of extremist and terrorism-related material to online fraud and cyber security attacks, is on the rise. This workshop aims to better understand such phenomena and develop methods for tackling them in an effective and efficient manner. The workshop brings together interdisciplinary researchers and experts in Web search, security informatics, social media analysis, machine learning, and digital forensics, with particular interests in cyber security. The workshop programme includes refereed papers, invited talks and a panel discussion for better understanding the current landscape, as well as the future of data mining for detecting cyber deviance.
Conference Paper
Full-text available
The role of Behavioural Evidence Analysis (BEA) has gained attention in the field of Digital Forensics in recent years. It has been recognized that, along with the technical examination of digital evidence, it is important to learn as much as possible about the individuals behind an offense, the victims and the dynamics of a crime. This can assist the investigator in producing a more accurate and complete reconstruction of the crime, in interpreting associated digital evidence and with description of investigative findings. Despite these potential benefits, the literature shows limited use of BEA for the investigation of cases of the possession and dissemination of Sexually Exploitative Imagery of Children (SEIC). This paper represents a step towards filling this gap. It reports on the forensic analysis of 15 SEIC cases involving P2P file sharing networks, obtained from the Dubai Police. Results confirmed the predicted benefits and indicate that BEA can help digital forensic practitioners and prosecutors.
Book
Full-text available
Terrorism, cyberbullying, child pornography, hate speech, cybercrime: along with unprecedented advancements in productivity and engagement, the Internet has ushered in a space for violent, hateful, and antisocial behavior. How do we, as individuals and as a society, protect against dangerous expressions online? Confronting the Internet's Dark Side is the first book on social responsibility on the Internet. It aims to strike a balance between the free speech principle and the responsibilities of the individual, corporation, state, and the international community. This book brings a global perspective to the analysis of some of the most troubling uses of the Internet. It urges net users, ISPs, and liberal democracies to weigh freedom and security, finding the golden mean between unlimited license and moral responsibility. This judgment is necessary to uphold the very liberal democratic values that gave rise to the Internet and that are threatened by an unbridled use of technology.
Article
Full-text available
The Internet is used by young people at risk of self-harm to communicate, find information, and obtain support. We aimed to identify and analyze websites potentially accessed by these young people. Six search terms, relating to self-harm/suicide and depression, were input into four search engines. Websites were analyzed for access, content/purpose, and tone. In all, 314 websites were included in the analysis. Most could be accessed without restriction. Sites accessed by self-harm/suicide search terms were mostly positive or preventive in tone, whereas sites accessed by the term ways to kill yourself tended to have a negative tone. Information about self-harm methods was common with specific advice on how to self-harm in 15.8% of sites, encouragement of self-harm in 7.0%, and evocative images of self-harm/suicide in 20.7%. Advice on how to get help was given in 56.1% of sites. Websites relating to suicide or self-harm are easily accessed. Many sites are potentially helpful. However, a significant proportion of sites are potentially harmful through normalizing or encouraging self-harm. Enquiry regarding Internet use should be routinely included while assessing young people at risk.
Article
Full-text available
Online sales of pharmaceuticals are a rapidly growing phenomenon. Yet despite the dangers of purchasing drugs over the Internet, sales continue to escalate. These dangers include patient harm from fake or tainted drugs, lack of clinical oversight, and financial loss. Patients, and in particular vulnerable groups such as seniors and minorities, purchase drugs online either naïvely or because they lack the ability to access medications from other sources due to price considerations. Unfortunately, high risk online drug sources dominate the Internet, and virtually no accountability exists to ensure safety of purchased products. Importantly, search engines such as Google, Yahoo, and MSN, although purportedly requiring "verification" of Internet drug sellers using PharmacyChecker.com requirements, actually allow and profit from illicit drug sales from unverified websites. These search engines are not held accountable for facilitating clearly illegal activities. Both website drug seller anonymity and unethical physicians approving or writing prescriptions without seeing the patient contribute to rampant illegal online drug sales. Efforts in this country and around the world to stem the tide of these sales have had extremely limited effectiveness. Unfortunately, current congressional proposals are fractionated and do not address the key issues of demand by vulnerable patient populations, search engine accountability, and the ease with which financial transactions can be consummated to promote illegal online sales. To deal with the social scourge of illicit online drug sales, this article proposes a comprehensive statutory solution that creates a no-cost/low-cost national Drug Access Program to break the chain of demand from vulnerable patient populations and illicit online sellers, makes all Internet drug sales illegal unless the Internet pharmacy is licensed through a national Internet pharmacy licensing program, prohibits financial transactions for illegal online drug sales, and establishes criminal penalties for all parties -- including websites, search engines, and health care providers -- who engage in and facilitate this harmful activity.
Article
This study is grounded in the considerable body of scholarship examining the increasing incidence of online hate in the cross-cultural framework, the massive rejuvenation and effective alteration of hate groups throughout the web, and the difficult tasks of the absolute free speech setting of the Internet. This research makes conceptual and methodological contributions to the elements that enable pernicious rhetoric to expand on the web, the explosion of racist and radical campaigns on the Internet, and the social underlying forces active in the online environment in relation to risk and ill-treatment.
Article
This Article provides a road map to issues of search engine law. It indicates what questions we must consider when thinking about search engines, and it indicates the interconnections among those questions. It does not endorse any particular normative framework for search. Nor does it recommend who should regulate search. Instead, it provides the necessary foundation for informed decision-making, by whatever regulator and whatever its normative approach. Part I will explain how modern search engines function and describe the business environment within which they operate. Search engine operations can be understood in terms of the information flows among four principal actors: search engines themselves, their users, information providers, and third parties (such as copyright holders and censorious governments) with interests in particular content flows. There are, in turn, four significant information flows: the indexing by which a search engine leans what content providers are making available, user queries to the search engine for information about particular topics, the results returned by the search engine to users, and finally, the context that providers send to users who have found them through searching. Because so many major search engines are funded through advertising, this Part will also includes a survey of how search engine advertising works and the distinctive fraud problems confronting search engines and their advertisers. Part II, the heart of the Article, will present a descriptive analysis of the legal struggles over search, showing how questions of search policy, many of which have long been latent in different fields of Internet law, are increasingly confronting lawyers, courts, and regulators. It will describe those struggles in terms of the legitimate interests that each of these actors brings to debates over search. Users want high-quality results without too great a sacrifice of privacy. Content providers want favorable placement in search results without paying more than their fair share of the costs of supporting search and without facing unfair competition from search engines. Third parties want to prevent unauthorized distribution of copyrighted content, to preserve their own privacy, to protect their reputation, and to preserve user virtue. And finally, search engines want to preserve their ability to innovate, to protect themselves from fraud, and to ensure that the search market remains open to competition. Each entry in this list of a dozen interests has its own associated legal theories; this systematic taxonomy allows us to recognize how any given legal theory affects the search ecology. Part III will then show, with five examples, how taking a broad view of search yields otherwise unavailable insights into pressing controversies. This is not to say that the end result must be a body of search-specific law, only to note that failing to consider the larger forces at work in search is antithetical to sensible policy-making. First, the broad, systematic view illustrates how various claims in search engine disputes can serve as functional substitutes for each other. Second, it shows that the degree of transparency of the search process is a highly contested variable, which some concerns pressing for greater transparency and some pressing for less. Third, it illustrates that user privacy is a deeply knotty problem, and that preserving reasonable user expectations will involve difficult trade-offs with other interests—including some of users’ own. Fourth, it shows that we require a theory of search engine speech; the most well-developed theory of search engine results as speech so far articulated by a court is insufficiently complex. And fifth, it illustrates the richness of debates over search engines’ relationship to providers’ trademarks.
Article
As information becomes a critical commodity in modern society, the issue is raised whether the entities that manage access to information, that are tools for public discourse and democracy, should be accountable to the public. The Internet has transformed how we communicate, and search engines have emerged as managers of information, organizing and categorizing content in a coherent, accessible manner thereby shaping the Internet user's experience. This article examines whether search engines should have public interest obligations. In order to answer this question, this article first examines comparative public interest regulatory structures, and the growing importance of the Internet to public discourse. Then examined is how the algorithmic designs and manual manipulation of rankings by search engines affects the public interest without a sufficient accountability structure. Finally, the values necessary to a public interest framework are suggested.
Addressing cyber harassment: an overview of hate crimes in cyberspace
  • Citrondk
Citron DK. Addressing cyber harassment: an overview of hate crimes in cyberspace. 6 Case W Res JL Tech & Internet 1. 2014.
Information-seeking on the internet: an investigation of websites potentially accessed by distressed or suicidal adolescents
  • Singaravelu
Netflix and Chill": freedom of expression and the chilling effect on user-generated content in Europe
  • M E Griffith
Griffith ME. Downgraded to "Netflix and Chill": freedom of expression and the chilling effect on user-generated content in Europe. Colum J Eur L 2015;22:355-81.
We don't collect or share personal information
  • Duckduckgo
DuckDuckGo. We don't collect or share personal information; https://duc kduckgo.com/privacy (accessed April 23, 2018).
  • France Toulouse
  • Piscataway
Toulouse, France. Piscataway, NJ: Institute of Electrical and Electronics Engineers, 2015;293-302.
Trigger warnings: what do they do?
  • Bbc News
BBC News. Trigger warnings: what do they do?; http://www.bbc.co.uk/ news/blogs-ouch-26295437 (accessed April 23, 2018).
Digital evidence discrepancies - Casey Anthony trial
  • Wilsonc
Wilson C. Digital evidence discrepancies -Casey Anthony trial; http:// www.digital-detective.net/digital-evidence-discrepancies-casey-anthonytrial/ (accessed April 23, 2018).
Market share held by the leading search engines in the United Kingdom (UK) as of
  • Statista
Statista. Market share held by the leading search engines in the United Kingdom (UK) as of July 2017; https://www.statista.com/statistics/ 280269/market-share-held-by-search-engines-in-the-united-kingdom/ (accessed April 23, 2018).
Search for images with reverse image search
  • Google
Google. Search for images with reverse image search; https://support. google.com/websearch/answer/1325808?hl=en (accessed April 23, 2018).
Search engine liability for autocomplete defamation: combating the power of suggestion
  • M L Smith
Smith ML. Search engine liability for autocomplete defamation: combating the power of suggestion. 2013 U Ill JL Tech & Pol'y 313 (2013).
My family's Google searching got us a visit from counterterrorism police
  • M Catalano
Catalano M. My family's Google searching got us a visit from counterterrorism police; https://www.theguardian.com/commentisfree/2013/aug/ 01/government-tracking-google-searches (accessed April 23, 2018).
Worldwide desktop market share of leading search engines from
  • Statista
Statista. Worldwide desktop market share of leading search engines from January 2010 to October 2017; https://www.statista.com/statistics/216573/ worldwide-market-share-of-search-engines/ (accessed April 23, 2018).
Burglar admits using Google Maps to find pricey homes
  • Nbc Chicago
NBC Chicago. Burglar admits using Google Maps to find pricey homes;
Snowden revelations push DuckDuckGo
  • Statista
Statista. Snowden revelations push DuckDuckGo; https://www.statista.c om/chart/1863/daily-searches-on-duckduckgocom/ (accessed April 23, 2018).
Google and Microsoft agree steps to block abuse images
  • Bbc News
BBC News. Google and Microsoft agree steps to block abuse images;
Fears over pro-suicide web pages
  • Bbc News
Search using autocomplete
  • Google
Downgraded to “Netflix and Chill”: freedom of expression and the chilling effect on user‐generated content in Europe
  • Griffith ME