Unfurl Unfurl 2025.03 Unfurl v2025.03 adds new features, including parsing Google Search's UDM parameter, support for Mastodon forks (like Truth Social), and a utility parser to "clean up" inputs.
Unfurl Unfurl v2025.02 Released Unfurl v2025.02 adds parsing of obfuscated IP addresses, more Bluesky timestamps, and more!
Unfurl Authenticating Screenshots from Netflix's Carry-On Movie I watch Netflix's Carry-On, notice a real Google Search URL on screen, extract lots of data points from it and "authenticate" the screenshot.
Unfurl Unfurl v2023.09 Released! Unfurl v2023.09 adds parsing for JWTs, URLs with encoded DoH (DNS over HTTPS) requests, and more Mastodon servers.
Unfurl Unfurl v2022.11: Social Media Edition This "social media edition" Unfurl release includes parsing Twitter sharing codes, timestamps from Mastodon and LinkedIn IDs, expanding Substack redirects, & more!
Unfurl More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02 Unfurl v2022.02 adds parsing for Google Search's aqs parameter, integrates MISP "warninglists", adds 3x more shortlink expansions, and more!
Unfurl Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15 A new Unfurl release is here! v2021.06.15 adds decoding of some Metasploit URLs, hash identification and API lookups, & more!
Hindsight Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl Plugin I'm
Presentations & Interviews Unfurl on "Life Has No Ctrl+Alt+Delete" A few weeks ago I was on "Life Has No Ctrl+Alt+Del" with @HeatherMahalik of Cellebrite giving an overview of Unfurl, how to use it, and walking through (many) examples. The video recording is now up!
Digital Forensics Tinkering with TikTok Timestamps I tinker with TikTok - and find a timestamp embedded in video URLs!
Unfurl New Unfurl Version Released A new version of Unfurl is here! v20200729 adds: improved Google Search URL parsing (RLZ and EI parameters), more short-link expansions, DuckDuckGo search parsing, mailto link parsing, and a better Docker setup.
Python Another Google Search Parameter? For RLZ! There are many query string parameters in Google Search URLs that hold interesting information. The rlz parameter is no exception, but thankfully it isn't as mysterious as many others; Google explains what the RLZ parameter is and how it functions in a white paper. From the Google Chrome
Unfurl Unfurl CLI version (and now on PyPI) A new Unfurl version brings a CLI tool & easier installs via PyPI.
Digital Forensics Unfurling Unknown Protobufs With this latest update, Unfurl can now parse protobufs as well! If you hover over a field, Unfurl tries to explain a bit about wire types and possible other data formats.
Tools Unfurl... in 3D Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!
Presentations & Interviews Talking about Unfurl on the Forensic Lunch Ryan Benson on Dave Cowen's Forensic Lunch talking about Unfurl (and other DFIR things).
Tools Featured Introducing Unfurl Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL up into components, extracting as much information as it can from each piece, and presenting it
