Digital Forensics

A collection of 33 posts

Hindsight

Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight

I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl Plugin I'm

Visualizations

Keystroke Flow from Chrome Omnibox

I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram.

Digital Forensics

A Year of #DailyDFIR

A look back at a year of tweeting every day about DFIR topics - including a recap of the most popular tweets, coverage trends, and what's next in 2021.

Chrome

New "Media History" File Added to Chrome

There's a new database added in Chrome 86, dedicated to tracking media playback. Here's a first look at its contents!

Digital Forensics

Tinkering with TikTok Timestamps

I tinker with TikTok - and find a timestamp embedded in video URLs!

Unfurl

Unfurl CLI version (and now on PyPI)

A new Unfurl version brings a CLI tool & easier installs via PyPI.

Digital Forensics

Unfurling Unknown Protobufs

With this latest update, Unfurl can now parse protobufs as well! If you hover over a field, Unfurl tries to explain a bit about wire types and possible other data formats.

Tools

Unfurl... in 3D

Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!

Web Browsers

Google "ved" Parameter Versions

The "ved" parameter in Google URLs contains valuable link context. I've found a new version ("v2") with more info!

Open Source Tools

Solving Magnet Forensics CTF with Plaso, Timesketch, and Colab

The folks at Magnet Forensics had a digital forensics-themed Capture the Flag competition and I wanted to take a crack at it using the open source tools we use/build here at Google: Plaso, Timesketch, and Colab/Python.

Web Browsers

A First Look at Chromium-Based Edge

A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome.

Web Browsers

Chrome Values Lookup Tables

I've fielded a few questions recently about what some value buried in a Chrome artifact means. I find myself going to the Hindsight source on GitHub and drilling down into the code because I know I have the values translated there. That seems kind of inefficient, so to

Tools

Chrome Evolution

Show One Level Show Two Levels Show All Version: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Digital Forensics

New Year, New dfir.blog

2019 is here and the new year brings something with it I've wanted to do for a while: re-launch my blog! It has a new look and a new home at dfir.blog. I've had some big changes in my life: I became a father and

Tools

Hindsight

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications - with more to come! Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache

Presentations & Interviews

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. My abstract was: Reviewing web browsing activity is relevant in a wide variety of DFIR cases. With many users having multiple devices that may need to be analyzed, we need better

Presentations & Interviews

Deciphering Browser Hieroglyphics

I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using a variety of open source tools. A recording of most of the talk is available YouTube

Visualizations

Visualizing Activity from Metadata

Encrypted iPhone backup? That means it's useless to an investigator (or attacker), right? Not so fast. We can still get an incredible amount of insight into the actions on the devices from the metadata alone. I am currently taking Sarah Edward's FOR518: Mac Forensic Analysis from

Web Browsers

Investigating Universal Analytics

Two common questions when investigating web browsing are: (1) how long did a user spend on a website, and (2) what actions did they take while on it? We have a number of methods of approximating what the user did and how much time they spent on a page, but

Open Source Tools

Alexa, Tell Me Your Secrets

The Amazon Echo is a nifty little device that you communicate with via speech - you can ask it to do various tasks and it verbally replies. You preface each command with the trigger word - either "Alexa", "Amazon", or "Echo". The Echo uses

Web Browsers

It's a "Brave" New World... or is it?

Brave is a new browser from some experienced people that aims to be faster and safer than other browsers by blocking ads and trackers. Brave also wants to disrupt the current online model where users pay for services with their privacy. The About page on Brave's website describes

Presentations & Interviews

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015

I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for extracting, interpreting, and reporting on Google Chrome artifacts. I went over how to use Hindsight to analyze a

Visualizations

Finding the First Thread with a Visualization

Finding the first thread to pull to get an investigation started can sometimes be difficult. Having a checklist and a structured approach to your investigation can help quite a bit. Experience also can help you come up with a list of artifacts to review and places to check, but what

Open Source Tools

Hindsight v1.5.0 released + GUI!

I am very excited to announce that Hindsight v1.5.0 is here! Graphical User Interface The core Hindsight functionality continues to see incremental improvements, along with quite a few internal changes to support new features that will appear in subsequent releases. However, the major change is that there is

Presentations & Interviews

Featured on Autopsy Blog

I will be speaking at the Open Source Digital Forensics Conference (OSDFCon) next month about a new tool I'm releasing. It's called SQUID, or SQLite Unknown Identifier, and it finds exact and near matches of SQLite databases based on database structure.   I spoke with the folks