Hindsight v2026.04 Released!

There's a new Hindsight release! New features in v2026.04 include:

• Parsing of Sessions_* and Tabs_* files (SNSS) into both the Timeline and a dedicated "Sessions" tab in the XLSX output
• Parsing of Platform Notifications (including when shown, clicked, and more!)
• More fields for URL Visit rows: Categories, Entities, Cluster, Window ID, Tab ID, and Response Code

There's also many other smaller changes and fixes; check out the complete release notes for more details. Read on for more details on the new features!

Session & Tabs Files

Chrome(ium)'s "Sessions" files (Session_* and Tabs_*) are a rich, but quickly-disappearing, artifact. They contain the information the browser needs to restore the user's tabs (if a crash happens or if the user has the browser set to "Continue where you left off" on startup). They contain things like the navigation index within the tab (for going forward and back), form data, iframe count, the tab ordering within the window, and a lot more. There is also some timing information, which is now in Hindsight's Timeline tab (rows starting with "session").

There's also a new "Sessions" tab that pulls a lot of this information together in a different view. I love timelines, but sometimes looking at the data in a different way is helpful too! The Sessions tab groups each open window, with the tab order within it, and then the navigation order within that tab.

Thanks (again) to Alex Caithness of CCL Solutions; his initial post on SNSS internals (way back in 2012, wow) introduced this artifact to me, and Hindsight uses ccl_chromium_reader as the base for parsing these SNSS files.

Platform Notifications

Browsers have the ability to send notifications to the host operating system (or "platform") to be shown natively. These are stored in a LevelDB called "Platform Notifications". This release adds notification (shown) and notification (clicked) rows to the Timeline:

There is more interesting data in the notification that doesn't fit neatly into the Timeline (including body text, icon, & embedded site-specific data); Hindsight stores this in the "Data" column (see above screenshot). Another shout-out to Alex Caithness; Hindsight again uses ccl_chromium_reader behind the scenes for most of the parsing here.

More Fields for URL Visit Rows

The Chrome History SQLite database file has continued to evolve over the (many) new Chrome releases, adding new tables inside it, but I haven't seen them being leveraged by investigative tools (Hindsight included). I'm trying to remedy this, so this is the first update on that journey.

For URL Visit rows, Hindsight now has columns for Categories, Entities, and Cluster. Each of these fields in raw form is an identifier: something like /m/020_7p for Categories and Entities, and a plain number (like 104) for Cluster.

Hindsight will try to resolve these to a more human-readable form. The /m/020_7p type identifiers are Google Knowledge Graph IDs, and Hindsight looks them up via the Google Knowledge Graph Search API (when a free Google API key is provided). That allows Hindsight to replace /m/020_7p with "Google" or /m/0dl567 with "Taylor Swift". For the Clusters, if there is a Cluster Label available in the History database, Hindsight will use that; if it, it will leave the plain number (which is still useful for grouping visits).

Also newly-added are Window ID, Tab ID, and Response Code. I have some ideas on how to leverage these for some different kinds of analysis and visualizations, but those didn't make it in this release. More to come 😄.

Get Hindsight!

You can get Hindsight, view the code, and see the full change log on GitHub. Both the command line and web UI versions of this release are available as:

• compiled exes attached to the GitHub release or in the dist/ folder
• .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.