Hindsight

Hindsight v2021.12

Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more!

Hindsight

Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight

I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl

Hindsight

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more!

Hindsight

Hindsight is 2020

Hindsight is 2020! ... ok, it's actually 20200607, but I've been waiting years to make a bad "Hindsight 2020" joke. There's a new version of Hindsight!

Open Source Tools

Hindsight v2.4 Adds JSONL Output

Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome (1-76), and other small fixes.

Web Browsers

A First Look at Chromium-Based Edge

A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome.

Open Source Tools

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes.

Tools

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications -

Open Source Tools

Hindsight v2.2 Parses More Chrome Preference Items

Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome. The quick version is: Support for Chrome versions 1 - 66Preference items with

Presentations & Interviews

Deciphering Browser Hieroglyphics

I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using

Open Source Tools

Hindsight v2 Adds a Web UI and Cache Parsing

Hindsight v2 is here! The new release brings new features, many of which are focused on ease-of-use, along with a refactoring of the code into a Python package pyhindsight. The

Web Browsers

Load Balancer Cookie Decoder

I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies. Adam Maxwell (@catalyst256) wrote a few blog posts describing

Presentations & Interviews

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015

I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for

Open Source Tools

It's All About Time - Hindsight v1.4 Released

Hindsight v1.4.0 is here and it has a number of improvements, all involving time. As usual, you can get the update from Github or grab the zip directly.

Open Source Tools

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging. Cookie DecryptionAs

Open Source Tools

Hindsight v1.1.0 Adds SQLite and JSON Outputs

Hindsight v1.1.0 is live! This first update since Hindsight migrated to Python about six weeks ago brings a number of improvements, but the biggest news is that Hindsight

Open Source Tools

Python version of Hindsight Released

Today I am releasing a Python version of Hindsight (a Google Chrome forensics tool). The original version was in Perl and I learned quite a bit about both Chrome and

Open Source Tools

Hindsight v0.84 Released

An update to Hindsight is now available! The new version (0.84) has some bug fixes and increased functionality (specifically regarding download records). Chrome made some significant changes to the

Web Browsers

Detecting Clock Changes Using Cookies

The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic. In his presentation and in another

Open Source Tools

Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)

A new version (0.83) of Hindsight is now available. Chrome changed how it saves download records as of version 26; the download url is now in a separate table

Open Source Tools

Hindsight Adds Parsing of Chrome Preferences file

After reading Jesse Kornblum's post Privacy Issues in Google Chrome are Opportunities for Forensic Examiners, I decided to see if I could incorporate some of the valuable information in the

Open Source Tools

Announcing Hindsight: A Free Chrome Forensics Tool

Hindsight is a free tool for extracting, interpreting, and reporting on Google Chrome artifacts. Hindsight can extract useful data from a number of Chrome artifacts, including URLs, archived URLs, the text content of some viewed pages (from Index data), download history, autofill records, normal

Subscribe to dfir.blog