What is private or incognito browsing?¶
Private or incognito browsing is a browser mode designed to reduce what is saved locally after the session ends.
What this means¶
It may avoid keeping ordinary browsing history, cookies, form entries and some temporary files.
The internet provider, website, employer, network administrator, app provider or other systems may still record the connection and activity.
Downloads, bookmarks, screenshots and files created during the session may also remain on the device.
The browser may still use DNS, network connections, account logins and device identifiers.
Notifications, caches, crash logs, memory, keyboard records, synced accounts and other applications may preserve traces.
The exact behaviour varies by browser, operating system and version.
People use it for shared devices, privacy, testing and ordinary account separation.
What to check or do next¶
- If the user signs into an account, the provider may associate the activity with that account.
- Investigators should not treat the absence of ordinary history as proof that no browsing occurred.
- Look at downloads, account activity, provider records, DNS, network logs, messages, screenshots and other device artefacts.
Evidential limits¶
It does not make the user anonymous.
Private mode also does not guarantee that no local artefacts remain.
Equally, do not assume that private mode proves wrongdoing.
The operational takeaway is: private browsing reduces some local records, but it does not erase the wider evidence trail. Investigate the device, account, network and provider evidence together.