Is chrome incognito mode cache stored on the disk or in the ram, and is it encrypted?
Information about chrome incognito mode and exactly what it does is kind of sparse. Obviously it wont mask your ip and logs of where you've been from your isp and the website you are visiting. What I am interested in is what it does with the actual files you download while browsing.
Best case scenario would be that chrome encrypts the cache and temporarily stores it in the ram memory while the session is active. This way anything chrome has downloaded while surfing will disappear and be completely unrecoverable, right?
Meh case scenario would be if chrome saves the cache in a temporary folder on the disc but encrypts it and once the session is over, it deletes the encrypted cache. The encrypted files can be recovered, but since they are encrypted they wont mean anything.
Worst case scenario would be if it just saves the file to the disk and deletes the files after the session. Any idiot with recuva can just recover the files.
Can someone please enlighten me to how it works? Thanks!
Answer
Chrome does store most of the data in the virtual memory (RAM) and therefore not stored on your disk BUT not all off the data is stored in RAM, some such as SESSIONS are stored in exactly the same place as if not in Incognito.You can open the Resource Monitor tool within Chrome, go to disk, sort the image column under the disk activity section, then open and incognito session and go to any website. You should see a few lines of your harddrive writing data to ...\chrome\user data\default\ even in incognito mode.
You can find out more about this here: https://www.magnetforensics.com/computer-forensics/how-does-chromes-incognito-mode-affect-digital-forensics/
Also if your interested in how incognito works and other steps you should take to stay anonymous online, take a look at this:
Hope I could help.