You Can Be Prosecuted for Clearing Your Browser History

Time to disable browser history altogether? Is storing things like that on a ramdisk considered destroying evidence when you power down?

Part of David Kernell's charge was defragmenting his hard drive! Seems a stretch since it's a legitimate maintenance task, or was more commonly useful in 2008. Hopefully they gave a decent argument that it was done with intent, and didn't just bamboozle the jury.

Considering that every second a computer is on, it's potentially losing forensic data, I guess they just want you to call the police immediately after doing anything on your computer that may have been illegal. But it's not self-incrimination!

It's also interesting that in that case, they caught a break in the form of malware that happened to log Kernell's activity.[1] It was "designed to collect a lot of different data (including) banking and finance data" -- but somehow I have a feeling they didn't lift a finger to prosecute that crime. Maybe they would if it embarrassed a Presidential candidate.

[1] http://www.knoxnews.com/news/local-news/fbi-kernell-tried-to...

So the thing is that when people do computer forensics, anti-forensics actions stand out clear as day on the machine and it does come up in a lot of cases. If you have some activity on a windows machine you want to hide, your best course of action is really to destroy the drive.

I think the feds essentially want to be able to "use" evidence of anti-forensics in court. This is actually reasonable, but the legal theory they're trying to do that with doesn't seem very suitable.

While genuine signs of anti-forensics should be admissible as evidence, it's hard to see how "destroying records" on a private computer (not for business use / at work) should be an actual crime, in and of itself. Also, "clearing browser history" as anti-forensics is seriously a reach. I do wonder if there were other actions taken (over and above clearing browser history) that weren't mentioned in the article.