The increasing use of encrypted data within file storage and in network communications leaves investigators with many challenges. One of the most challenging is the Tor protocol, as its main focus is to protect the privacy of the user, in both its local footprint within a host and over a network connection. The Tor browser, though, can leave behind digital artefacts which can be used by an investigator. This paper outlines an experimental methodology and provides results for evidence trails which can be used within real-life investigations.

中文翻译：

---

Tor浏览器捆绑软件的法证审核

文件存储和网络通信中加密数据的使用日益增加，使调查人员面临许多挑战。最具挑战性的之一是Tor协议，因为它的主要重点是在主机内部和网络连接中保护用户的隐私。不过，Tor浏览器可能会留下调查人员可以使用的数字文物。本文概述了一种实验方法，并提供了可用于现实调查中的证据线索的结果。