If you are investigating a webpage or website, we know that there is certain information that our browser tells that server or website about who we are and potentially where we are. So how does the investigator implement Tor during their investigations? Well, the simplest method is to use the Tor network to hide browsing activity. This is due to the increase in most users’ Internet bandwidth, the constant upgrading and improving of the Tor software and its easy integration into the popular browsers. Using Tor during online investigations is much easier now than in the past. You can still use the installed “Vadalia” (like the onion) package to proxy your own browser through the Tor network, although the Tor project no longer recommends this practice. The current Tor Browser bundle installs its own browser version that does not allow the user to change the proxy settings in the browser. Thus you have effectively hidden from the end website you are visiting or target user that you may be communicating with through the Internet (Please note this is an over simplification of the process and exact details of how the Tor network works can be found on the project website). The Tor network in its simplest description strips that information out and only provides the end user with an IP address belonging to the Tor network and not you.

This exposure of your IP address is what can tell the target who you are and possibly where you are in the world.

These servers easily identify who you are by your IP address so they can communicate back with you. Your browser normally makes a call out through your Internet Service Provider to servers on the Internet.

The onion router