## 10 Results and Discussion  
In this section, we discuss the effectiveness of the proposed protocol, D2 WFP, by examining and performing a quantitative evaluation which consists of comparing the results found in the forensic testing of the D2 WFP against the results generated from the automated DFIR tools and framework, namely FTK, AXIOM, and UFED. The carried testing is limited to the use of an anonymity and privacy-preserving browser in criminal activities and only covers artefacts recovered from criminal machines or devices. During the elaboration of the protocol, several tests were carried out, and the results obtained enabled us to make some tweaks or changes to improve the D2 WFP. The first set of tests covered a comparative analysis of the number of investigative leads (deep and dark web artefacts) related to web browsing using TOR. We clearly distinguished the higher number of artefacts indexed when adopting the D2 WFP than those indexed using the relevant tool/framework. The difference observed is significantly higher in Linux, Windows, and Android and notably in the number of browsing history, cache, and temporary files. The D2 WFP outperforms the automated tools in all other categories, such as security, logins, SQLite DB forms, and downloads. In the iOS context, despite having the number of indexed browsing artefacts in favour of the D2 WFP, the gap is less significant due to the security and memory handling restrictions implemented in the iOS and macOS. The analysis of the ongoing results illustrates the D2 WFP's effectiveness in locating, extracting, and exploiting deep and dark web activities through indexing by, on average, 35-45% more than the number of artefacts discovered by industrial tools when working in regular automation mode. The second set of tests covered the analysis of the four forensic images obtained after running an anti-forensic software BleachBit version 4.4.1 to erase browsing data artefacts. Here, again, the obtained results illustrate the effectiveness of the D2 WFP compared with regular automated DFIR tools and frameworks in terms of the number of deep and dark web artefacts related to web browsing using TOR indexed. The proportion in terms of the difference between regular automation in FTK, AXIOM, and UFED compared with the D2 WFP is distinguished, notably the higher number of artefacts indexed in browsing, security, and cache when the figures show that by adopting the D2 WFP, the number of indexed artefacts (mostly recovered and carved) is four times higher compared with the number of artefacts indexed using the relevant tool/framework. The observed difference is significantly higher in Linux, Windows, and Android, particularly in the number of browsing history, cache, and temporary files. The D2 WFP outperforms the automated tools in all other categories, such as security, logins, SQLite DB forms, and downloads. In the \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Artefacts**} & \multirow{2}{*}{**Protocol**} & \multirow{2}{*}{**Windows 10**} & **Linux** & \multirow{2}{*}{**Android 11**} & **Apple** \\  & & & **Kali 2021** & & **iOS 14.2** \\ \hline \multirow{2}{*}{**Browsing**} & Regular & 107 & 239 & 226 & 287 \\  & **D2 WFP** & **679** & **799** & **804** & **453** \\ \hline \multirow{2}{*}{**Security \& Logins**} & Regular & 07 & 09 & 06 & 02 \\  & **D2 WFP** & **17** & **19** & **20** & **09** \\ \hline \multirow{2}{*}{**Cache \& Temp**} & Regular & 1126 & 907 & 1372 & 774 \\  & **D2 WFP** & **4681** & **5414** & **5755** & **2413** \\ \hline \multirow{2}{*}{**SQLite DB Form**} & Regular & 15 & 44 & 67 & 06 \\  & **D2 WFP** & **354** & **403** & **409** & **154** \\ \hline \multirow{2}{*}{**Downloads**} & Regular & 25 & 29 & 22 & 09 \\  & **D2 WFP** & **109** & **174** & **188** & **68** \\ \hline \hline \end{tabular}
\end{table}