Skip to content
Skip to main content
Mobile Devices & Apps Technical Explainer

Does private browsing leave no evidence?

No. It can suppress routine local history while downloads, open tabs, accounts, network records and other device artefacts remain.

Evidence depends on session and timing

A live session can retain tabs and memory. After closure, files, bookmarks, screenshots, keyboards, notifications and system logs may survive. Signed-in services can hold provider activity, while DNS and network systems may record connections.

Broaden without promising recovery

Identify browser, version, device state and whether the session remained open. Compare accounts, linked devices, provider returns and network evidence. Missing standard history is a limitation, not proof that browsing did not happen; private-session content may still be unrecoverable.

Key takeaway

Investigate beyond the history list and report both surviving traces and the records private mode prevented or removed.

Reference: MDA-113Mobile Devices & Apps