Description:TECHNICAL FIELD
The present disclosure relates generally to forensic systems and more specifically relates to digital forensic systems for analysis history of users.

BACKGROUND ART
[0001] Foresight investigations must follow a rigid set of procedures and guidelines in order for the evidence to be admissible in court. The method and process used to gather the data and get the outcomes should be repeatable.

[0002] As the number of internet users grows by the day, so do the number of internet-related crimes. Digital forensics is the practise of extracting information from digital devices and determining if the device has previously been hacked or is now being inspected. The primary goal of digital forensics is to collect "evidence" from crime scenes. Digital forensics is a subset of computer forensics that encompasses digital electrical technologies such as mobile phones and printers. Web browser forensics is an important aspect of computer forensics because evidence gathered from user internet activity may be used in a wider variety of criminal and civil cases.

[0003] Nowadays, there are techniques that exists which are used to analyze search engines. For example, reference can be made to US10972573B1 which disclose identifying root HTTP and child HTTP. Further, a reference can be made to US8977618B2 which discloses enhancing job search results for both job seekers looking for jobs and employer/recruiters looking for job candidates. However, none of the prior art discloses techniques for determining and representing user history in different forms.

OBJECTS OF THE INVENTION
[0004] The principal object of the present invention is to provide techniques for analyzing user history in a search engine.

[0005] Another object of the present invention is to provide techniques for improving user experience by displaying user history in different formats to a user.

[0006] Another object of the present invention is to provide techniques for determining a number of times a user visits a website on a search engine.

[0007] Another object of the present invention is to provide techniques for presenting names of the websites visited by a user.

SUMMARY OF THE INVENTION

[0008] In one embodiment, a system A system for determining user history are disclosed. The system comprises an input unit (102) configured to receive input regarding a search string from a user, a memory (104) configured to store user history, wherein the user history includes websites searched by the user using the search string, a processor (106) configured to analyse the user history and a display unit (108) configured to display the analysed user history in different forms.

[0009] In another embodiment, a method for determining user history is disclosed. The method comprises receiving input regarding a search string from a user, storing user history, wherein the user history includes websites searched by the user using the search string, analysing the user history and displaying the analysed user history in different forms.

BRIEF DESCRIPTION OF DRAWINGS
[0010] Figure 1 illustrates a system for determining user history, in accordance with one embodiment of the present invention.
[0011] Figure 2 illustrates a display screen of the system, in accordance with one embodiment of the present invention.
[0012] Figure 3 illustrates a display screen of the system, in accordance with another embodiment of the present invention.
[0013] Figure 4 illustrating a flowchart of a method for determining user history, in accordance with the present invention.
DETAILED DESCRIPTION OF THE INVENTION
[0014] While the present invention is described herein by way of example using embodiments and illustrative drawings, those skilled in the art will recognize that the invention is not limited to the embodiments of drawing or drawings described and are not intended to represent the scale of the various components. Further, some components that may form a part of the invention may not be illustrated in certain figures, for ease of illustration, and such omissions do not limit the embodiments outlined in any way. It should be understood that the drawings and the detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the invention is to cover all modifications, equivalents, and alternatives falling within the scope of the present invention as defined by the appended claim.
[0015] As used throughout this description, the word "may" is used in a permissive sense (i.e. meaning having the potential to), rather than the mandatory sense, (i.e. meaning must). Further, the words "a" or "an" mean "at least one” and the word “plurality” means “one or more” unless otherwise mentioned. Furthermore, the terminology and phraseology used herein are solely used for descriptive purposes and should not be construed as limiting in scope. Language such as "including," "comprising," "having," "containing," or "involving," and variations thereof, is intended to be broad and encompass the subject matter listed thereafter, equivalents, and additional subject matter not recited, and is not intended to exclude other additives, components, integers, or steps. Likewise, the term "comprising" is considered synonymous with the terms "including" or "containing" for applicable legal purposes. Any discussion of documents, acts, materials, devices, articles, and the like are included in the specification solely for the purpose of providing a context for the present invention. It is not suggested or represented that any or all these matters form part of the prior art base or were common general knowledge in the field relevant to the present invention.
[0016] In this disclosure, whenever a composition or an element or a group of elements is preceded with the transitional phrase “comprising”, it is understood that we also contemplate the same composition, element, or group of elements with transitional phrases “consisting of”, “consisting”, “selected from the group of consisting of, “including”, or “is” preceding the recitation of the composition, element or group of elements and vice versa.
[0017] The present invention is described hereinafter by various embodiments with reference to the accompanying drawing, wherein reference numerals used in the accompanying drawing correspond to the like elements throughout the description. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiment set forth herein. Rather, the embodiment is provided so that this disclosure will be thorough and complete and will fully convey the scope of the invention to those skilled in the art. In the following detailed description, numeric values and ranges are provided for various aspects of the implementations described. These values and ranges are to be treated as examples only and are not intended to limit the scope of the claims. In addition, several materials are identified as suitable for various facets of the implementations. These materials are to be treated as exemplary and are not intended to limit the scope of the invention.
[0018] Referring to FIG. 1, a system 100 for identifying user history is disclosed. The system 100 comprises of an input unit 102, a memory 104, a processor 106 and a display unit 108. The processor 106 is coupled to the input unit 102, the memory 104 and the display unit 108 and may perform one or more instructions stored in the memory 104.
[0019] In one embodiment, the system 100 may be a computer device which may be used to run one or more search engines. In another embodiment, the system 100 may be any other computing device, such as a laptop, a mobile device, a tablet device. In other words, the system 100 may be any device responsible for running search engines.
[0020] The system 100 may be connected to a server 110 via a network 112. The system 100 may be responsible for fetching content from the server 110 and present it to the users. The content may be related to any search query run by the user on the system 100. The query may be run in view of the desire by the user to search a content on the server.
[0021] The input unit 102 receives one or more input from a user. The user may input one or more key words for inputting as the search string. The search strings are input in a search engine. The search engine may be an application which provides web browsing experience to the user. In one embodiment, the search engine may be Google chrome. In another embodiment, the search engine may be Firefox.
[0022] In one embodiment, a user may visit a plurality of websites using the search engine at different point of time. For example, the user may search for a content in Google.com, attend a meeting in Google Meet, watch videos on Youtube.com, visit Linkedin.com, etc. The search engine may store all the websites visited by the user.
[0023] In one embodiment, the user may use the search engine in different ways. For example, the user may open the search engine (for example, google chrome) and may browse the search engine for few hours without closing the search engine. This may be termed as a single session. Thus, in the single session, the user uses the search engine for few hours without closing the search engine.
[0024] In another embodiment, the user may use the search engine in different sessions. For example, the user may search for content Google.com at a particular time and then close the search engine. At another time, the user may again use the search engine and attend a meeting on Google Meet and then again close the search engine. In another embodiment, the user may again use the search engine at another point of time.
[0025] The user history includes the websites accessed by the user in the single session and the websites accessed by the user in the different sessions. In one embodiment, the user history may be stored in the memory 104. In another embodiment, the user history may be stored in the server 110. To access the user history, the system 100 may reach out to the server 110 and fetch the user history.
[0026] In Google Chrome, the user history may be stored in the form of sqlite3 data. In another words, a user history file may be created by the Google Chrome and stored in the form of sqlite3 data. This file may be stored in the memory 104 or stored in the server 110. The user history file may include a compressed form of all the user data comprising the data from the single session and different sessions.
[0027] The processor 106 fetches the user history file from the memory 104 or from the server 110. After fetching the user history file, the processor 110 analyzes the file to determine the following:
a. a number of websites visited by the user;
b. an amount of time spent by the user on each website;
c. number of times a website was visited;
d. time at which each of the website was visited;
e. location where the website was accessed;
f. a number of times a website was visited by user in a single session;
g. a number of times a website was visited by user in different sessions.
h. top searches according to the search engine history
i. top keywords, download history in graphical or tabular formats.
j. analyses the latest sqlite3 database of search engine compared to old SQLITE databases
k. analyze the chrome history, cookies, bookmarks, and download section.
However, above points are mere examples and the user history file can include any history of the user.
[0028] In one embodiment, processor 106 may generate a report of the websites visited by the user. The report may include number of times the website is visited along with the time at which the website is visited. In one embodiment, the report may include a log of the user. In one embodiment, the processor 106 may be part of a universal serial bus (USB) tool. The tool runs on all major platforms thus providing extensive support. The tool can also be integrated with any major forensic tool to generate a suite.
[0029] Referring to FIG. 2 now, an example of display unit 108 is shown, according to one embodiment of the present invention. The display unit 108 shows the websites in the form of pie chart. Although, pie chart is shown, user history can be represented in any form (such as graph, line diagram). The pie chart shows top 10 sites visited by a user. The sites are represented in the form of percentage of time spent by the user on a website. In one embodiment, the percentage can also represent a number of times the user visited the website. For example, Google.com was used 29.4% of times out of all the sites visited by the user (or a user spent 29.4% of time on Google.com).
[0030] Referring to FIG. 3 now, an example of display unit 108 is shown, in accordance with another embodiment of the present invention. The display unit 108 represents user history in tabular form. One side of the table shows the name of the website while the other side shows a corresponding number of times the user visited the website. For example, Google.com was visited 4438 times by the user. Similarly, mail.google.com was visited 3482 times by the user.
[0031] Referring to FIG. 4 now, a flowchart of a method for determining user history is shown. At step 402, the method comprises receiving search strings from a user in a search engine to access a website. At step 404, the method comprises accessing the website searched by the user. At step 406, the method comprises analyzing the websites accessed by the user. At step 408, the method comprises representing the analyzed websites in different forms.
[0032] The various actions, acts, blocks, steps, or the like in the flow diagram may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some of the actions, acts, blocks, steps, or the like may be omitted, added, modified, skipped, or the like without departing from the scope of the invention.
[0033] Although particular embodiments of the invention have been described in detail for purposes of illustration, various modifications and enhancements may be made without departing from the spirit and scope of the invention.

, Claims:I/We Claim:
1. A system for determining user history, the system comprising:
an input unit (102) configured to receive input regarding a search string from a user;
a memory (104) configured to store user history, wherein the user history includes websites searched by the user using the search string;
a processor (106) configured to analyse the user history;
a display unit (108) configured to display the analysed user history in different forms.

2. The system as claimed in claim 1, wherein the display unit (108) is configured to display the user history in the graphical format.

3. The system as claimed in claim 1, wherein the display unit (108) is configured to display the user history in tabular form.

4. The system as claimed in claim 1, wherein the analysed user history comprises latest sqlite3 database of Chrome browser.

5. The system as claimed in claim 3, wherein the user history comprises top websites visited by the user, top keywords used by the user, cookies, bookmarks and download section.

6. A method for determining user history, the method comprising:
receiving input regarding a search string from a user;
storing user history, wherein the user history includes websites searched by the user using the search string;
analysing the user history;
displaying the analysed user history in different forms.

7. The method as claimed in claim 6, further comprising displaying the user history in the form of pie chart.

8. The method as claimed in claim 6, further comprising displaying the user history in tabular form.

9. The method as claimed in claim 7, wherein the pie chart represents top websites visited by the user.

10. The method as claimed in claim 8, wherein the user history comprises top websites visited by the user, top keywords used by the user, cookies, bookmarks and download section.