Hindsight adds Firefox support!

Ryan Benson -

A new Hindsight release is here! v2026.06 includes:

  • Support for parsing Mozilla Firefox artifacts! This is the first non-Chromium-based browser supported by Hindsight
  • Parsing Service Worker-related data
  • Enhanced extension handling (reworked XLSX tab and more parsed info)
  • Better downloads parsing (more columns and reading shared_proto_db)

There's also many other smaller changes and fixes; check out the complete release notes for more details. Read on for more details on the new features!

Firefox Support

Hindsight can now parse artifacts from Mozilla Firefox! This brings Hindsight closer to being a comprehensive browser forensics tool. I would like to thank Steven R. Schiavone of the Westchester County District Attorney's Office for contributing this to Hindsight; it's wonderful to have users contribute new features to the tool.

Parsed artifacts from all browser profiles are merged into a single "Timeline" tab in the XLSX output, letting investigators more easily see cross-browser user activity. This is similar to how Hindsight previously handled parsing multiple Chrome profiles; now it's expanded to multiple browsers!

Artifacts with similar functions are labeled with the same row type (url, cookie (created), autofill, and so on) to enable investigators to easily scan or filter cross-browser.

Service Workers

Service workers do a lot in modern browsers, including caching, syncing, push notifications, letting (some) sites work offline, and enabling browser extensions (see next section). I haven't seen much (any?) research on them from a forensics and parsing perspective, so it was a fun side project to dive into these a bit more.

There's a new "Service Workers" tab in the XLSX output that shows the new data; it's organized in a hierarchy, starting with the origin (it's all extension origins in the screenshot, but doesn't have to be), then the registration, and finally any resources. This is all parsed from a Service Workers\Database LevelDB, so we can get some historical (and deleted) records as well (all the light gray rows in the screenshot).

Enhanced Extension Handling

Extensions also got a refresh. The "Extensions" tab is now hierarchical as well, showing the extension name, ID, and install-related information as a top row, then permissions and any scripts or grants nested below it:

More Information on Downloads

There have been some new fields added to the downloads table in the History database in the past few years. Below is the list of new columns being parsed, along with the Chrome version they were introduced:

  • referrer (v29),
  • by_ext_id & by_ext_name (v30)
  • mime_type & original_mime_type (v37)
  • guid, hash , http_method, site_url, tab_url, tab_referrer_url (v51)
  • last_access_time, transient (v59)
  • by_web_app_id (v115)
  • url_chain : the redirect chain from downloads_url_chains is now collapsed into one entry per download (final hop is the download URL) instead of one row per hop

Hindsight now also parses the shared_proto_db, which has some unique fields not present in the History DB:

  • download_source (how the download was triggered, from download_pb.DownloadSource)
  • request_headers
  • fetched_via_service_worker
  • storage_partition

Not every download is recorded in both places, but some are. The shared_proto_db has internal things (like downloading extensions from the Web Store, and downloads made via internal APIs) that aren't present in the History downloads table.

Lastly, Hindsight now adds a download (opened) row with the last_access_time timestamp if the user opened the download via the browser.

Get Hindsight!

You can get Hindsight, view the code, and see the full change log on GitHub. Both the command line and web UI versions of this release are available as:

  • compiled binaries attached to the GitHub release
  • .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.