Hindsight - dfir.blog

Hindsight

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications - with more to come! Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies).

Hindsight v2021.12

Hindsight v2021.12

Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more!

Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight

I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl Plugin I'm

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more!

Hindsight is 2020

Hindsight is 2020! ... ok, it's actually 20200607, but I've been waiting years to make a bad "Hindsight 2020" joke. There's a new version of Hindsight!

Hindsight v2.4 Adds JSONL Output

Open Source Tools

Hindsight v2.4 Adds JSONL Output

Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome (1-76), and other small fixes.

A First Look at Chromium-Based Edge

A First Look at Chromium-Based Edge

A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome.

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Open Source Tools

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes.

Hindsight

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications - with more to come! Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache

Hindsight v2.2 Parses More Chrome Preference Items

Open Source Tools

Hindsight v2.2 Parses More Chrome Preference Items

Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome. The quick version is: * Support for Chrome versions 1 - 66 * Preference items with timestamps now are in the Timeline * Improvements to logging Both the GUI and command line versions of this release

Deciphering Browser Hieroglyphics

Presentations & Interviews

Deciphering Browser Hieroglyphics

I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using a variety of open source tools. A recording of most of the talk is available YouTube

Hindsight v2 Adds a Web UI and Cache Parsing

Open Source Tools

Hindsight v2 Adds a Web UI and Cache Parsing

Hindsight v2 is here! The new release brings new features, many of which are focused on ease-of-use, along with a refactoring of the code into a Python package pyhindsight. The highlights are: * Cross-platform web UI * Easier installation on all OSes - now just do pip install pyhindsight * Ability to parse

Load Balancer Cookie Decoder

Load Balancer Cookie Decoder

I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies. Adam Maxwell (@catalyst256) wrote a few blog posts describing his process of figuring out how to decode the cookie and finished it off by releasing a Python script that

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015

Presentations & Interviews

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015

I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for extracting, interpreting, and reporting on Google Chrome artifacts. I went over how to use Hindsight to analyze a

It's All About Time - Hindsight v1.4 Released

Open Source Tools

It's All About Time - Hindsight v1.4 Released

Hindsight v1.4.0 is here and it has a number of improvements, all involving time. As usual, you can get the update from Github or grab the zip directly. New(ish) Plugin: Time Discrepancy Finder - Back in the old Perl version of Hindsight, I wrote a plugin that

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Open Source Tools

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging. Cookie Decryption As of v33, Chrome encrypts cookie values on Windows, Mac, and Linux. The cookies table in 'Cookies' database

Hindsight v1.1.0 Adds SQLite and JSON Outputs

Open Source Tools

Hindsight v1.1.0 Adds SQLite and JSON Outputs

Hindsight v1.1.0 is live! This first update since Hindsight migrated to Python about six weeks ago brings a number of improvements, but the biggest news is that Hindsight can now output to JSON and SQLite in addition to the original XLSX format. The added output formats make the

Python version of Hindsight Released

Open Source Tools

Python version of Hindsight Released

Today I am releasing a Python version of Hindsight (a Google Chrome forensics tool). The original version was in Perl and I learned quite a bit about both Chrome and Perl while developing it. I wanted to learn more about Python (since the DFIR community seems to be shifting to

Hindsight v0.84 Released

Open Source Tools

Hindsight v0.84 Released

An update to Hindsight is now available! The new version (0.84) has some bug fixes and increased functionality (specifically regarding download records). Chrome made some significant changes to the way it stores download records in v26 and added in even more fields in v30. In v26, Chrome stopped storing

Detecting Clock Changes Using Cookies

Detecting Clock Changes Using Cookies

The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic. In his presentation and in another post, Lee mentions that when someone clicks on a G+ link, the user is first sent to a

Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)

Open Source Tools

Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)

A new version (0.83) of Hindsight is now available. Chrome changed how it saves download records as of version 26; the download url is now in a separate table (downloads_url_chains) and a few new columns were added to downloads (including danger_type and interrupt_reason). The Bookmarks

Hindsight Adds Parsing of Chrome Preferences file

Open Source Tools

Hindsight Adds Parsing of Chrome Preferences file

After reading Jesse Kornblum's post Privacy Issues in Google Chrome are Opportunities for Forensic Examiners, I decided to see if I could incorporate some of the valuable information in the Chrome Preferences file into the report Hindsight produces. I updated the core Hindsight program to create another tab

Open Source Tools

Announcing Hindsight: A Free Chrome Forensics Tool

Hindsight is a free tool for extracting, interpreting, and reporting on Google Chrome artifacts. Hindsight can extract useful data from a number of Chrome artifacts, including URLs, archived URLs, the text content of some viewed pages (from Index data), download history, autofill records, normal cookies, and Local Storage records (HTML5