谷歌浏览器隐私模式的用户浏览数据恢复

对谷歌浏览器多进程技术的工作原理及其源码进行了研究，分析了浏览器进程空间中的数据，设计了一种谷歌浏览器隐私模式下的用户浏览数据恢复方案。该方案依据进程EPROCESS结构中的成员信息，提取隐私模式谷歌浏览器所有进程的内存空间数据，将每个浏览器进程的内存空间数据与目标浏览数据的模板进行匹配，从而恢复出用户使用隐私模式的谷歌浏览器上网产生的浏览数据。实验结果表明，该方案可以从内存镜像中恢复用户的浏览数据。

User browsing-data recovery of Google browser in private-browsing mode

This article studies the Google chrome''s mechanism of multi-process technology and its source code, and analyzes the data in browser process''s memory space, then, designs a recovery scheme for user''s browsing-data of Google browser in private-browsing mode. First, this proposal extracts the data of all Google chrome''s processes in memory with the member information of the process''s EPROCESS structure, and then, matches the data of every individual process''s memory space with the target browsing data''s template, thus, it can recover the browsing-data which are generated when the user surfer internet using Google browser. Experiments show that this scheme can recover the user''s browsing-data from the physical memory images.