In digital forensics, one of the complicated tasks is analyzing web browser data due to different types of devices, browsers, and the absence of modern analytical approaches. Browsers store a large amount of information about user activity because users most often access the internet through them. However, existing approaches to analyzing this browser data still have gaps. Existing approaches fail to provide a comprehensive and precise representation of user activity. This article examines the internal architecture of web browsers as stored in the memory and storage subsystems of various devices, including desktop and mobile platforms. A novel method is proposed that integrates machine learning algorithms, such as k-nearest neighbors and Naive Bayes, to automatically analyze browser data, identify suspicious login activities, and construct user behavior profiles. The results indicate that the proposed method and the developed platform can effectively construct individual user behavior profiles. Moreover, this approach not only productively observes top visited domains and main user’s favorite website categories, but also highlights suspicious websites and user’s login attempts. Compared to existing browser forensic tools which have less capabilities, the proposed technique provides increased accuracy (more than 90%) in automated user profiling and detection of suspicious user activity.

NAND flash-based solid state drives (SSDs) are increasingly common in computers, but they present a problem for forensic data recovery. SSDs use controller logic, flash translation layers, error correction, wear leveling, TRIM, garbage collection, and encryption to influence the recoverability of data after being written or erased, which is not the case for hard disk drives (HDDs). In this paper, we propose a machine learning-based method to determine the health of NAND SSDs and their data recoverability. The approach involves telemetry (SMART and NVMe) analysis, subsystems’ interpretation of NAND and controller health, and anomaly detection with the Isolation Forest machine learning algorithm. The task is formulated as a single-class learning problem that takes into account asymmetry, where telemetry from a healthy SSD represents the reference state and NAND degradation, controller instability, TRIM effects, and encryption-related limitations act as asymmetric deviations from this state. The presented method uses telemetry data, such as the temperature, wear level, spare blocks, media and data integrity errors, error logs, unsafe shutdowns, and uptime. This study shows that the potential for data recovery depends on the health of the NAND flash memory and controller, TRIM, encryption, and other anomalies but not necessarily any single SMART metric. The proposed approach provides explainable, data recovery-focused assessment and categorizes the SSD cases as recoverable, partially recoverable, and non-recoverable. The model was trained using a healthy SSD dataset consisting of 56,482 SATA SSD records and 82,665 NVMe SSD records, for a total of 139,147 healthy drive samples. Additionally, 20,000 synthetic training samples were generated for each SSD type to support controlled model training. The proposed platform was evaluated using 30 SSD recovery scenarios, including recovery, partial recovery, and no recovery cases. The results demonstrate that the proposed method can distinguish between healthy, warning, and abnormal SSD states and provide recovery recommendations based on NAND health, controller stability, TRIM status, and encryption limitations.

In digital forensics, one of the complicated task is analyzing web browser data due to different types of devices, browsers and no updated approaches. Browsers store a large amount of information about user activity because users most often access the internet through them. However, existing approaches to analyzing this browser data still have gaps. One of the main problem developed platforms based on the old methods can not show complete information about the user's activity and have issues with precision. The article discusses the internal architecture of the browser, which is stored in the memory drives inside devices, for instance, computers or mobile devices. The research paper offers solution with developed module based on new method which integrates machine learning algorithms, such as K-NN algorithm and Naive Bayes. The main purpose of the paper it is shows new method which can automatically analyzes browser's data, detects suspicious login activity, and generates user behavior profile. The results show that the proposed new method , on which the developed platform is based, demonstrates user's profile by interests, emotional state and financial state. Also it possible to see list of top visited domain and main user's favorite website categories. It has been found that our methods shows with high accuracy 99.9\% . Also the result of new method , on which the developed platform is based shows the suspicious web-sites and user's logins. Compared to Oxygen Forensics and Nirsoft which less capabilities., the proposed method provides increased accuracy , automated user profiling and detection of suspicious user's activity.

The rapid growth of internet usage has significantly increased the volume of digital traces created by users, making web browsers a critical source of evidence in digital forensics. Web browsers store extensive user-related data, including browsing history, search queries, visited domains, cookies, and cache files, which collectively reflect behavioral patterns and decision-making processes. However, existing forensic tools primarily focus on manually extracting and visualizing browser artifacts, providing limited capabilities for automated behavioral analysis. This study addresses this shortcoming by proposing an automated method for identifying and analyzing user behavioral patterns based on web browser activity using machine learning techniques. The proposed approach is based on extracting and structuring browser history data from personal computers, followed by similarity-based classification using the k-nearest neighbors algorithm. Behavioral characteristics are extracted from recurring search queries, domain frequency, and content categories of visited websites, enabling the creation of a structured behavioral dataset. To justify the model selection, the k-nearest neighbors classifier was evaluated alongside logistic regression and Gaussian naive Bayes classifiers using standard performance metrics, including accuracy, precision, recall, F1-score, and area under the curve. Experimental results show that the k-nearest neighbors model achieves the highest recall and F1-score, indicating superior performance in identifying clustered and nonlinear patterns of user behavior compared to the baseline and probabilistic models. The results confirm that similarity-based classification is particularly effective for browser activity analysis, where user actions tend to form localized groups in high-dimensional feature spaces. The proposed method enables the transformation of raw browser data into interpretable user behavior profiles that integrate interests, behavioral indicators, and visit frequency statistics. This improves the practical applicability of web browser analysis by supporting structured behavioral assessment rather than raw data analysis. Overall, the study demonstrates the feasibility and effectiveness of integrating machine learning-based behavioral analysis into web browser forensics workflows and lays the foundation for future research incorporating temporal features, larger datasets, and hybrid learning approaches.