Browser forensic evidence supports HR investigations into policy violations, data exfiltration, workplace harassment plus inappropriate use of corporate systems. The browser artifacts available include history, downloads, cookies, autofill data, cached files plus bookmarks. These artifacts survive most attempts at coverup including incognito browsing in many cases. This guide covers what evidence browser forensics actually produces, what does not survive specific user actions plus how to handle the evidence in a way that holds up in arbitration or litigation that follows an HR investigation.
The HR investigation evidence landscape
HR investigations typically arise from policy violation complaints, suspected data exfiltration before an employee resignation, harassment investigations involving online behavior plus suspected inappropriate use of corporate systems. The evidence needed to support a defensible HR determination often includes records of what websites the employee accessed, what files they downloaded or uploaded, what searches they performed plus what online services they used.
Browser forensic evidence answers these questions directly. The browser stores extensive records of online activity in ways that survive most user attempts at coverup. Even when the employee believes they have cleared their tracks, professional forensic recovery typically surfaces the evidence the investigation needs.
The challenge HR teams face is that browser evidence requires technical forensic recovery to be useful as evidence. Simply asking the IT team to look at the employee's browser produces partial results that may not survive arbitration. The forensic process produces evidence with documented integrity that arbitrators plus litigation counsel can rely on.
Browser artifacts available to forensic recovery
Modern browsers (Chrome, Edge, Firefox, Safari) store user activity in multiple artifact categories. The Sherlock Browser Viewer recovers all of these categories from a forensic disk image.
History database: URLs visited with timestamps, visit count, transition type (typed vs clicked vs autocomplete), time spent on each URL plus referrer. The history database is SQLite for Chrome, Edge plus Firefox; SQLite or proprietary format for Safari. History persists indefinitely unless the user explicitly clears it plus often survives clear-history actions in recovered space.
Download records: filename, source URL, target path, file size, timestamps for start plus completion plus download status (completed, paused, interrupted). Download records are stored separately from history plus often survive when history has been cleared.
Cookie database: domain, name, value, expiration, secure plus HttpOnly flags. Cookies provide evidence of session state with specific services plus may include identifying information for authenticated sessions.
Autofill data: form field values the user typed into web forms (names, addresses, search queries, phone numbers). Autofill data is one of the strongest behavioral evidence sources because it directly records what the user typed rather than what they viewed.
Cached files: partial copies of pages, images, scripts plus other content downloaded during browsing. Cache content often includes versions of pages that have since changed online, providing point-in-time evidence of what content was available when the user visited.
Bookmarks plus folder organization: URLs the user deliberately saved for future reference. Bookmarks indicate intent to return to specific content plus often survive attempts at evidence destruction because users do not think to delete them.
Extension data: installed browser extensions plus their stored data. Extensions may include password managers, VPN clients, screen-capture tools, ad blockers plus other software that affects what the user did online.
Session restore data: tabs the user had open at last browser close, including URLs that may not have made it into the history database because the page failed to load completely.
What incognito mode does plus does not hide
Incognito mode (Chrome / Edge) plus Private Browsing (Firefox / Safari) is the most commonly invoked coverup technique by employees under investigation. The honest forensic answer is that incognito mode is much less private than most users believe.
What incognito hides: the browser does not write history entries, does not store cookies past the session, does not retain autofill data plus does not save cache files to persistent disk. The browser presents a cleaner state when incognito closes.
What incognito does NOT hide: the operating system pagefile may contain memory pages with URLs the browser visited; the system DNS cache records domains the browser resolved; the corporate network proxy or firewall logs show requests by source IP; downloads to disk are not affected by incognito (the download record is suppressed but the file itself lands on disk); browser extensions installed in incognito session may persist data; bookmarks made during incognito are saved permanently; the file system journal may record temporary cache files even if they were deleted; the LiveData (in-memory state) is recoverable from memory acquisition if the system is still running.
For HR investigations, the practical implication is that incognito mode does not block forensic recovery. The evidence may require deeper forensic techniques (pagefile analysis, network log correlation, memory acquisition) but the underlying activity is recoverable in most cases. We covered this in detail in our fact check on incognito mode anonymity.
The forensic acquisition process for HR investigations
The acquisition process that produces defensible evidence in HR investigation contexts:
Preserve the workstation: the employee workstation should be preserved with documented chain of custody from the moment HR makes the investigation decision. Avoid actions that modify the workstation state (no exploratory browsing on the device, no software installation, no remote access except for forensic imaging). The Sherlock Disk Imager produces forensically sound images with hash verification suitable for the evidence package.
Acquire forensic image: capture a bit-for-bit copy of the workstation drive. The image includes all browser artifact files plus the surrounding operating system state needed for context analysis (pagefile, registry, file system journal).
Recover browser artifacts: use forensic tools to extract the artifacts from the image without modifying the source. The Browser Viewer pulls history, downloads, cookies, autofill, cache, bookmarks plus extension data from Chrome, Edge, Firefox plus Safari browser profile directories within the image.
Timeline reconstruction: correlate browser activity with operating system activity. The Sherlock Universal Events Viewer reads Windows event logs to surface logon sessions, file access plus USB device connections that frame the browser activity. The combined timeline answers questions like "what was the employee doing on the day they accessed prohibited content" with the evidentiary detail HR needs.
Cross-correlate with corporate logs: network proxy logs, email gateway logs plus VPN concentrator logs provide additional evidence sources. The forensic timeline from the workstation cross-references with these external logs to produce a complete picture.
Examiner report: the forensic examiner produces a written report covering acquisition method, artifacts recovered, timeline plus findings. The report is signed plus includes hash verification of the source image. The report is the deliverable HR uses to support arbitration, litigation or termination decisions.
Common HR investigation scenarios
Several scenario classes recur across HR investigations Sherlock Forensics supports:
Suspected data exfiltration before resignation: the employee gave notice and HR wants to determine whether company data was uploaded to personal cloud services. Browser evidence shows uploads to Dropbox, Google Drive personal accounts, WeTransfer, file.io plus similar services. Download history shows what files were downloaded from corporate systems before the upload. Autofill data shows what email addresses the employee used to log into personal cloud services.
Workplace harassment investigation: the complainant alleges harassment based on online behavior. Browser evidence shows whether the accused employee visited sites or content related to the alleged behavior. Search history shows specific queries that may corroborate or refute the allegation. Social media activity may be partially recoverable through cached page content.
Inappropriate use of corporate systems: the employee is suspected of using corporate equipment for personal purposes that violate policy. Browser evidence quantifies the scope (how many hours per week, what specific sites, what content categories). The quantification supports proportional disciplinary response.
Suspected outside business activity during work hours: the employee is suspected of running a side business during work hours using corporate systems. Browser evidence shows access to side-business management tools (Shopify admin, Stripe dashboard, Mailchimp), competitor research patterns plus client communications. Email forensic evidence from the Sherlock PST Viewer complements browser evidence for the email correspondence side.
Policy violation around content access: the employee is suspected of accessing content categories explicitly prohibited by acceptable use policy. Browser evidence shows specific URLs visited plus time spent. Cache content may include screenshots of the actual content viewed.
Evidence integrity considerations
Browser evidence must be acquired plus handled in ways that survive challenge in arbitration or litigation that may follow the HR action. Several considerations apply:
Chain of custody: the workstation custody must be documented from the moment HR initiates the investigation. Every transfer of custody plus every access to the workstation is logged.
Forensic imaging: analysis must be performed on a forensic image, not the live workstation. Working from the live system modifies evidence plus invites challenge.
Hash verification: the forensic image hash plus the per-artifact hashes are documented at acquisition. The hashes prove the evidence presented in arbitration is the evidence as acquired.
Tool documentation: the forensic tools used must be documented (vendor, version, command line). Tool documentation supports the examiner attestation that the analysis was performed according to documented procedure.
Examiner qualifications: the examiner who performs the analysis must have qualifications that support their attestation. Certifications, training plus prior expert witness experience demonstrate competence.
Reasonable expectation of privacy: the legal posture varies by jurisdiction. Corporate workstation evidence is typically subject to lower privacy protection than personal device evidence, but the specifics depend on the employee handbook plus acceptable use policy in force. Legal counsel should review the investigation scope before acquisition.
What this means for HR investigation planning
The mistake HR teams make is assuming browser evidence is either obviously available or obviously gone. Neither is true. Browser evidence is recoverable through forensic process in most cases including when the employee believed they had covered their tracks. The recovery requires forensic expertise plus tools.
The honest practitioner posture is to engage forensic support early in significant HR investigations. The forensic process produces evidence with documented integrity that supports defensible HR determinations. The cost of forensic engagement is materially below the cost of HR action that gets reversed in arbitration because the evidence was acquired in ways that did not hold up under challenge.
The Sherlock Forensics services practice supports HR investigations across mid-market and enterprise customers. The forensic toolchain includes the Sherlock Disk Imager for evidence-grade workstation acquisition, the Sherlock Browser Viewer for browser artifact recovery, the Sherlock PST Viewer for email correspondence forensics, the Sherlock Universal Events Viewer for workstation timeline reconstruction plus the supporting forensic examination services.
Talk to our team about HR investigation forensic support, workplace investigation protocol or evidence package preparation for ongoing arbitration.
Browser evidence supports defensible HR determinations. Get the Sherlock Browser Viewer for forensic browser artifact recovery. Talk to our team about HR investigation support.