On the system where the TOR browser is installed, the following location are of high importance. By hiding the true IP address of the user, attempts to trace or identify the user are nearly impossible without the use of extraordinary methods. The browser modifications hide the user’s originating Internet Protocol (IP) address when surfing websites or sending e-mail. It supports all major operating systems (Windows, Linux, and Mac), can be used without installation, and can run from within a USB stick. The TOR browser is a hardened, security-focused version of Firefox that pushes all of your Web traffic through TOR’s anonymizing network. It is also called relay or router all three names are interchangeable. The term node generally refers to a computer or a server that operates as part of the TOR network.

Making Tor traffic even more difficult, if not impossible, to track is that this random route chooses a different entry, middle, and exit relay every 10 minutes or so. The exit relay does not know anything of the traffic route other than the single previous relay. When using TOR, the IP address of the user will become hidden and the user's connection will seem to originate from the TOR exit relay. The exit relay now connects to the desired target of the user with an unencrypted connection. The next node performs the same function until the message reaches the final node, which is also named exit relay. As the encrypted data enters the first node, one layer of encryption is stripped and sent to the next node. It then sends them through a virtual circuit consisting of many nodes (three or more). The data and destination IP address are first layered with elliptic curve cryptography, which is currently unbreakable with brute-force. Tor directs the route of a user’s internet traffic through random relays on the Internet.

The main aim of this post is to provide a forensic analysis of the software that runs the tor client on the PC (the TOR browser) How TOR works A network of volunteer computers that directs traffic anonymously through the internet.The software that runs the tor client on the PC of the user.

Tor browser osx