Tor video traces:
a clue is not attribution.

What the browser is designed to retain.

The Tor Project states that Tor Browser does not keep browsing history by default and that cookies last only for a session. This makes a conventional persistent-history search an unreliable starting assumption. It does not establish the content of a particular operating-system acquisition.

Source: Tor Project — about Tor Browser

Examine acquired artifacts, not assumptions.

A supported examination may inspect acquired database pages, journals, crash dumps or memory-related files for surviving strings and recognizable media structures. Availability depends on the browser version, session state, operating system, acquisition and what was overwritten. The existence of these files is not guaranteed, and a generic cache or shader file is not automatically a video buffer.

An administrator account does not guarantee readable access to a live pagefile. Record acquisition errors and inaccessible regions instead of describing them as scanned. A stream fragment may also lack the configuration and reference frames needed for playback.

Correlate before attributing.

An .onion URL can be a lead. To associate it with media, record the artifact containing the URL, its byte location, the surviving relationship to the media and any relevant timestamp source. Distinguish an explicit artifact relationship from proximity or another heuristic. An onion string in a file does not establish the browser, user action, downloading or viewing.

Conversely, a media file without an onion reference must remain unclassified. Filtering only positive metadata matches can exclude relevant content whose provenance did not survive. A broad content search avoids that exclusion but cannot manufacture attribution.

Ask a narrower, answerable question.

“Which acquired artifacts support a relationship between this media and this URL?” is more useful than “find every Tor video.” Record positive findings and coverage limits. Absence of a matching artifact does not demonstrate absence of browser activity.

Frame Witness does not guarantee Tor attribution, complete browsing history or recovery of overwritten media. No affiliation with the Tor Project is implied.

Public feedback only. Do not post case evidence or identifying information.