Komparasi Ketahanan Bukti Forensik Artefak Chrome dan Edge Terhadap Anti-Forensik Clear Browsing Data Menggunakan Kerangka Investigasi Forensik

This study examines the persistence of digital artifacts in Chromium-based web browsers, specifically Google Chrome and Microsoft Edge, after the application of anti-forensic actions through the Clear Browsing Data feature. This feature is commonly used by cybercrime perpetrators to remove traces of user activity, thereby complicating digital forensic investigations. The research applies the National Institute of Justice (NIJ) forensic investigation framework, which consists of identification, collection, examination, analysis, and reporting stages. Data acquisition was conducted using FTK Imager on the User Data directories of both browsers. The acquired artifacts were further analyzed using Autopsy, DB Browser for SQLite, and ChromeCacheView. The examined artifacts include browsing history, cookies, login data, cache, LevelDB, IndexedDB, favicons, and session-related data. The results indicate that Microsoft Edge demonstrates higher artifact persistence with a recovery percentage of 62.5%, compared to Google Chrome at 43.75%, meaning that Edge retains more residual traces after data deletion. However, Chrome shows greater effectiveness in removing primary artifacts, achieving 75% compared to Edge at 50%. These findings confirm that browser artifacts can still be recovered even after clearing browsing data and provide valuable recommendations for digital forensic investigators in prioritizing browser-based evidence collection.