Google search results going secure, what does this mean for forensics?

Jon Rajewski computer forensics, cryptology, google

If you run a search on Google.com, your Internet search is likely recorded and logged in several places. Digital forensic examiners leverage this feature in digital forensic exams. Investigators can serve Google with the appropriate legal paperwork to determine a specific users searches while they were logged into Google. The latter is hard to obtain and the former is a standard practice in digital forensic exams.

If you’re logged into Google all search results will soon be encrypted. That means that Internet browsers will treat those transactions like any other https communication – they won’t cache. So finding Google searches “screenshots” like “how do I get around my employers internet blocking software” in an employment technology misuse case won’t be possible..  Well it could, if you can obtain the Google Web History logs that cache every Google search a user makes – but as noted above you will likely need consent and/or legal authorization similar to a search warrant.

Edit:
That said, you should still be able to recover the Google Search Query in the browser records – For example here is a test I just ran from the new https://google.com link:

digital computer forensics is a science jonathan rajewski

Happy Forensicating!