It's All About Time - Hindsight v1.4 Released

Hindsight v1.4.0 is here and it has a number of improvements, all involving time.  As usual, you can get the update from Github or grab the zip directly.

New(ish) Plugin: Time Discrepancy Finder - Back in the old Perl version of Hindsight, I wrote a plugin that compared server-side timestamps to local ones to try and spot any differences and a companion blog post about detecting clock changes using cookies.  I hadn't previously had the chance to convert that plugin for the Python version of Hindsight, but I have now.  I also repeated my process for locating timestamps set by the server (rather than the local browser) and added about a dozen new ones to the plugin.  This plugin is now included by default when a user downloads Hindsight from Github.

Millisecond precision for timestamps - Chrome uses Webkit timestamps for many things, and those record to the microsecond. Hindsight previously only reported to the second, but I've changed it to show milliseconds now (microseconds seemed like overkill).  One caveat here is that if a timestamp doesn't have milliseconds, it is shown as having .000 milliseconds, which makes me cringe a bit as I can picture my engineering professors chastising me for incorrect usage of significant figures.

Visit Duration - Starting in version 20, Chrome added a visit_duration field, the purpose of which is to:

// Record how much time a user has this visit starting from the user   
// opened this visit to the user closed or ended this visit.   
// This includes both active and inactive time as long as   
// the visit was present.

(from https://src.chromium.org/svn/trunk/src/chrome/browser/history/history_types.h)

This definition tracks with my testing, as the visit_duration field appears to be a count of how long a page has been open.  It doesn't matter if the user is looking at the page, or is viewing a different tab, or has Chrome completely minimized.  As long as the tab is open, the counter keeps running.

Hindsight now has a column for 'Duration' in the 'URL Specific' section that shows this value.  I think this is a pretty neat artifacts, as I'm not aware of any other browser that explicitly tracks this.

Timezone Support - Hindsight now lets the user specify the display timezone for all timestamps.  I had a question from a user (thanks John!) about the display timezone, which prompted me to dig a bit and make some improvements.  Previous versions of Hindsight would display timestamps in the timezone of the examiner's system.  Now there is a new command line option, -t or --timezone, that lets the user specify the display timezone in Olson format.  In the XLSX report, the timezone all the timestamps are in is shown in the title of the 'Timestamp' column.

Internally Using datetime Objects - To help make manipulating timestamps easier, Hindsight now stores timestamps as Python datetime objects, rather than (milli)seconds since epoch.  This is just a behind-the-scenes change and shouldn't effect most end users.

Those are the high points of this update.  If you have any questions, comments, feedback, bug reports or feature requests, please drop me a message as I'd love to hear them.