Google Desktop as a Source of Digital Evidence

This paper discusses the emerging trend of Personal Desktop Searching utilities on desktop computers, and how the information cached and stored with these systems can be retrieved and analysed, even after the original document has been removed. Focusing on the free Google Desktop application, this paper first analyses how the program operates, the processes involved, files created and altered, and methods on retrieving this data without corrupting the contents. Whilst some discussion is specific to the Google Desktop application, other discussion is applicable to the several other, similar available applications. The limitations of extracting data from Google Desktop and other desktop searching utilities are also discussed, along with possibilities for future research to ensure that the repositories of information that these programs store may be forensically analysed.