<![CDATA[The use of Tor Browser as a digital anonymity platform continues to increase alongside the growing demand for internet privacy. Although Tor is designed to conceal user identities and activities through onion routing mechanisms, previous studies have shown that digital artifacts can still be recovered from the host system. This study aims to analyze the existence of digital artifacts generated by Tor Browser usage on the BackBox Linux operating system using a host-based digital forensics approach. The research employed an experimental method consisting of seven testing scenarios, namely behavioral forensic leakage, session persistence, cross-session correlation, host versus virtualization comparison, memory footprint analysis, network pattern consistency, and passive onion observation. Data acquisition and analysis were conducted using Autopsy, Hindsight, Plaso, LiME, Volatility, Bulk Extractor, and Wireshark. The results indicate that Tor Browser usage still leaves digital artifacts within storage media, volatile memory, and network traffic. This study concludes that the host-based digital forensics approach remains effective for identifying Tor Browser activities in Linux environments.]]>
Copyrights © 2026
