Hindsight v2.2 Parses More Chrome Preference Items

Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome. The quick version is:

• Support for Chrome versions 1 - 66
• Preference items with timestamps now are in the Timeline
• Improvements to logging

Both the GUI and command line versions of this release are available as:

• compiled exes (attached to the release or in the dist/ folder)
• .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.

The Detailed Version

The biggest artifact change that came with Chrome v66 was that three columns in the Cookies database were renamed:

• httponly -> is_httponly
• persistent -> is_persistent
• secure -> is_secure

This is a pretty minor thing, but Hindsight used some of those columns to ID what potential versions of Chrome it was processing, so the renaming broke some stuff. Trying to parse data from Chrome v66 or later with Hindsight v2.1.1 or earlier may fail due to Hindsight not being able to figure out the Chrome version. I also made some small changes to enhance the logging that Hindsight does.

Now for the new stuff: I've added in support for parsing a wider array of preference items. Hindsight previously parsed out a number of interesting preferences and showed them on a separate 'Preferences' tab, since they didn't have associated timestamps and thus would have been out of place on the primary 'Timeline' tab. I've added in parsing a few more preference items there, but the bigger news is the addition of some timestamped preferences to the 'Timeline' tab.

Chad Tilbury showed that Chrome's new 'Mute site' ability had a corresponding artifact in the Preferences file:

I thought this was pretty cool, and spent a little time digging in to see what other items with timestamps were lurking in Preferences.

Preference Items

I found eight types of preference items with timestamps that looked interesting. I haven't fully explored all the details, but here examples of each type (including the 'Mute' artifact):

"http://obsidianforensics.com:80,*": {
    "last_modified": "13160264938091184",
    "setting": {
        "hasHighScore": false,
        "lastMediaPlaybackTime": 0.0,
        "mediaPlaybacks": 0,
        "visits": 1
    }

"http://aboutdfir.com:80,*": {
    "last_modified": "13162626153701643",
    "setting": {
        "lastEngagementTime": 13162626153701620.0,
        "lastShortcutLaunchTime": 0.0,
        "pointsAddedToday": 4.5,
        "rawScore": 4.5
    }

"https://www.youtube.com:443,*": {
    "last_modified": "13161568350592864",
    "setting": 1
   }

"https://www.mapquest.com:443,*": {
    "last_modified": "13161750781018557",
      "setting": {
          "Geolocation": {
              "ignore_count": 1
 }}}

"https://www.youtube.com:443,*": {
    "last_modified": "13162624224060055",
    "setting": 2
}

"autoupdate": {
    "last_check": "13162668769688981",
    "next_check": "13162686093672995"
}

"signin": {
    "signedin_time": "13196354823425155"
 }

"translate_last_denied_time_for_language": {
   "iw": [1492489197120.853],
   "mt": [1487824811164.411],
   "pt": [1502849632254.548]
 }

Some items, like media_engagement and site_engagement, had more data in them than others, but an immediate use for them doesn't jump out at me. However, they could be a useful source of context or corroboration, so I included them. permission_autoblocking_data can have different subkeys, depending on the permission and the action, and looks like it can be used to determine if a website requested a particular API (Geolocation, for example). The last preference I wanted to mention are the translate_last_denied_time_for_language keys. Again, I think this artifact is would likely be used as context, but I still think it's pretty neat to be able to see evidence that a user loaded a page, then dismissed the translation prompt; this at least shows they interacted with the page in some fashion.

Get the New Version

Both the GUI and command line versions of this release are available as:

La elección se vuelve más sencilla cuando se aclara el uso principal de la camiseta. La decisión gana claridad cuando se puede revisar el estado indicado cuando se trate de una prenda de colección. La información reunida en «» ayuda a examinar las diferencias entre opciones relacionadas. Antes de finalizar el pedido, merece la pena confirmar la talla y la variante seleccionadas.

コスプレ衣装を選ぶ際は、サイズ表、素材、付属品、発送予定日を確認すると比較しやすくなります。条件に合う選択肢を探す際は、コスプレ衣装 即日発送 通販を手掛かりに内容を確認できます。注文前に使用日と発送予定を照らし合わせ、試着や調整に使える時間も確保しておくと安心です。

La elección se vuelve más sencilla cuando se aclara el uso principal de la camiseta. La decisión gana claridad cuando se puede revisar el estado indicado cuando se trate de una prenda de colección. La información reunida en «equipaciones del Mundial de fútbol» ayuda a examinar las diferencias entre opciones relacionadas. Antes de finalizar el pedido, merece la pena confirmar la talla y la variante seleccionadas.

• compiled exes (attached to the release or in the dist/ folder)
• .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.