Python - dfir.blog

Python

A collection of 11 posts

Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight

I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl Plugin I'm

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more!

Another Google Search Parameter? For RLZ!

Another Google Search Parameter? For RLZ!

There are many query string parameters in Google Search URLs that hold interesting information. The rlz parameter is no exception, but thankfully it isn't as mysterious as many others; Google explains what the RLZ parameter is and how it functions in a white paper. From the Google Chrome

Unfurl CLI version (and now on PyPI)

Unfurl CLI version (and now on PyPI)

A new Unfurl version brings a CLI tool & easier installs via PyPI.

Hindsight is 2020

Hindsight is 2020! ... ok, it's actually 20200607, but I've been waiting years to make a bad "Hindsight 2020" joke. There's a new version of Hindsight!

Unfurling Unknown Protobufs

Digital Forensics

Unfurling Unknown Protobufs

With this latest update, Unfurl can now parse protobufs as well! If you hover over a field, Unfurl tries to explain a bit about wire types and possible other data formats.

Hindsight v2.4 Adds JSONL Output

Open Source Tools

Hindsight v2.4 Adds JSONL Output

Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome (1-76), and other small fixes.

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Open Source Tools

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes.

Upgrading Python's SQLite

Open Source Tools

Upgrading Python's SQLite

SQLite and Python in DFIR SQLite databases are being used in more and more applications, and thus forensic examiners are increasingly running across them in investigations. Python seems to be one of the languages of choice for the DFIR community, and so SQLite and Python often intersect. I've

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Open Source Tools

Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging

Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging. Cookie Decryption As of v33, Chrome encrypts cookie values on Windows, Mac, and Linux. The cookies table in 'Cookies' database

Python version of Hindsight Released

Open Source Tools

Python version of Hindsight Released

Today I am releasing a Python version of Hindsight (a Google Chrome forensics tool). The original version was in Perl and I learned quite a bit about both Chrome and Perl while developing it. I wanted to learn more about Python (since the DFIR community seems to be shifting to