Overview

Microsoft Internet Explorer introduced a number of new security and privacy features in version 8.  One of these new features was InPrivate Filtering.  InPrivate Filtering helps prevent the web sites a user visits from automatically sending details about the visit to other content providers.

 

PrivacIE entries are not from InPrivate browsing sessions.

 

When a user visits a web site, it automatically shares standard computer information with that web site.  If the web site contains content provided by a third-party web site (for example a map, advertisement, or web measurement tools such as a web bug or scripts) some information about the user may be automatically sent to the content provider.  This type of arrangement can have several benefits.

  • It lets the user conveniently access third-party content.
  • The presence of advertising on a web site may let the web site provide access to premium content at no charge.

However, there can be an impact on user privacy as a result because it is possible for the content providers to track the user across multiple web sites.  When InPrivate Filtering is used, some web sites might be prevented from automatically sharing details about the visit with the providers whose content is displayed.  As a result, some content might be automatically blocked (such as weather information or advertisements).  The user can manually allow blocked content by adjusting the InPrivate Filtering settings.

PrivacIE Entries

When performing a forensic examination of INDEX entries from Internet Explorer, you may come across numerous PrivacIE Type entries.  These entries are URL records for third-party content providers.  If the user has InPrivate filtering on, the PrivacIE INDEX.DAT stores the URLs to third party content. They are not InPrivate browsing records.  InPrivate Filtering helps prevent website content providers from collecting information about sites the user has visited.  For example, the Digital Detective web sites use Google Analytics to track information about visitors to our sites.  Google tracks the data and provides webmasters with analytical tools to review the results.  If you switch InPrivate filtering on and visit  http://www.digital-detective.net , you will find two entries in the PrivacIE INDEX which get generated from the visit.

 

INDEX.DAT entries
PrivacIE:google-analytics.com/*/__utm.gif 
PrivacIE:google-analytics.com/*/ga.js

 

The first entry is a web bug which takes the Google Analytic information as a command line parameter.  The second entry is a Google Analytic script.

 

 

 PrivacIE entries also have a portion of the URL removed and replaced with an asterisk as can be seen in the figure above.

Removing InPrivate Filter Entries

The user can remove the (PrivacIE) entries relating to InPrivate Filtering in the same way as clearing the History or Cache.  In the Delete browsing History dialogue, there is an entry for InPrivate Filtering as shown in Figure 1 below.

 

Figure 1

 

Internet Explorer can also be configured not to record this information, even if the functionality is active.

 

Figure 2