International Journal of Science and Technology (IJST)

Novel Forensic Methodology for Extracting Geolocation Data from Browser Cache Artifacts

Modern digital forensics make more use of geolocation evidence, which is helpful to understand where and when users have been active, as well as identify their possible association with a particular place or even an object. Conventional geolocation methods usually consider IP address tracking, GPS coordinates extracted from mobile devices and user-owned media, as well as location services on such devices. However, the current state of web technologies allows one to collect geolocation information not only from IP addresses but also by considering the process of automatic caching online content, including images, maps, and other relevant artifacts generated within the web browser environment. Thus, the purpose of this paper is to discuss a new forensic methodology aimed at collecting geolocation-related information using artifacts stored in the browser cache folder. The main aspects to be considered include cache image recovery, metadata extraction, map tile artifact analysis, as well as finding coordinates based on the information provided by web browser. An experiment was conducted to find out if the suggested approach is appropriate for geolocation investigation.