Hindsight

No entries match these filters. Clear filters

1. v2026.06 Jul 8, 2026 · issue 014

   Hindsight v2026.06 adds full Mozilla Firefox support and expands Chrome extension, download, and Service Worker parsing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.06 https://github.com/RyanDFIR/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2026.06

   ⤢
   └──▷ TRY IT
   Analyze a Firefox profile on Windows and export results to XLSX for timeline review.
   copy

   $ hindsight.py -i "C:\Users\Investigator\AppData\Roaming\Mozilla\Firefox\Profiles\abc123.default" -b Firefox -o firefox_case

   Analyze a Chrome profile with all expanded download metadata and extension details written to XLSX.
   copy

   $ hindsight.py -i "C:\Users\Suspect\AppData\Local\Google\Chrome\User Data\Default" -o chrome_case -f XLSX

   • Adds Mozilla Firefox browser support: parses places.sqlite (history, bookmarks, downloads), cookies.sqlite, formhistory.sqlite, permissions.sqlite, logins.json, extensions.json, sessionstore, favicons, cache2, localStorage, IndexedDB, and bounce-tracking/content-blocking databases.
   • Adds Firefox HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks. pin parsing from SiteSecurityServiceState.bin and forensically relevant preferences from prefs.js.
   • Adds Firefox bookmark backup parsing from bookmarkbackups/*.jsonlz4, enabling recovery of deleted bookmarks from daily snapshots.
   • Adds parsing of Service Worker-related data, including Background Fetch, Background Sync, Cache Storage, Content Index, Cookie Store, Notifications, and Payments protobuf artifacts.
   • Enhances Chrome extension handling: merges data from disk and Secure Preferences, adds a dedicated Extensions worksheet in Excel output, and surfaces detailed permissions and content scripts.

   +4 more show less

   • Expands Chrome downloads parsing to include URL chains, MIME types, shared_proto_db download records, and additional metadata fields reflected in XLSX output.
   • Adds support for parsing and summarizing Chrome Declarative Net Request (DNR) dynamic rules and improves unpacked extension handling.
   • Adds browser auto-detection and support for Chromium variants including Edge, Brave, Vivaldi, and Tor Browser.
   • Includes pure-Python Snappy and Mozilla LZ4 (mozLz40) decoders, removing dependencies on python-snappy and python-lz4 for Firefox artifact decompression.

   9 details in Everything

2. v2026.04 May 2, 2026 · release notes

   Hindsight v2026.04 adds Chrome session reconstruction, platform notifications parsing, and Knowledge Graph entity resolution.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.04 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2026.04

   • Adds Chrome session analysis and session reconstruction, surfacing browsing session timelines in XLSX output with a dedicated Sessions tab.
   • Adds parsing of platform (OS-level) notifications from Chrome using ccl_chromium_reader.
   • Adds Knowledge Graph entity resolution and category enrichment for Chrome history artifacts.
   • Adds parsing of additional Chrome cookie fields (top_frame_site_key) for richer cookie artifact detail.
   • Adds support for the opener_visit field in Chrome history data to track referral chains between visits.

   +4 more show less

   • Adds experimental support for new cache types: DawnCache, DawnWebGPUCache, and DawnGraphiteCache.
   • Adds an explicit Source Item column in output rows to identify where each artifact was sourced from.
   • Enhances Chrome IndexedDB processing for Blob artifacts.
   • Extends Chrome version support up to version 145.

   9 details in Everything

3. v2026.01 Jan 30, 2026 · release notes

   Hindsight v2026.01 adds Chrome Sync Data parsing, permission_actions extraction, Login Data For Account support, and a richer CLI UI.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.01 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2026.01

   • Adds parsing of Chrome Sync Data, including originator GUIDs and simplified labels for sync records.
   • Adds parsing of permission_actions from the Chrome Preferences file.
   • Adds support for parsing the Login Data For Account database in Chrome.
   • Adds translation of accountcapabilities from Preferences to human-readable values.
   • Introduces the rich library for improved CLI UI/UX and artifact processing output.

   +5 more show less

   • Expands JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output with parsing for Chrome IndexedDB, Extension Storage, Sync Data, and Installed Extensions record types.
   • Improves SQLite output to be comparable to XLSX and JSONL outputs.
   • Adds updated parsing for changes to DIPS introduced in Chrome v142.
   • Adds new danger_type and interrupt_reason codes for download artifact analysis.
   • Adds generic parsing for simple preference timestamp values.

   10 details in Everything

4. v2025.03 Mar 10, 2025 · release notes

   Hindsight v2025.03 adds Extension Data parsing with a new output tab, table, permissions, and manifest fields.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2025.03 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2025.03

   • Parses multiple Chrome extension-related databases, surfacing results in a new Extension Data output tab and table.
   • Outputs extension permissions and manifest details alongside existing extension records.
   • Exports Extension Data to the SQLite output format.

   3 details in Everything

5. v2024.10 Nov 4, 2024 · release notes

   Hindsight v2024.10 adds DIPS database parsing, IndexedDB record parsing, and Windows 11 profile path support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2024.10 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2024.10

   • Parses the DIPS (Detect Incidental Party State) database, including new columns and the popups table, exposing Chrome's third-party cookie interaction tracking.
   • Parses IndexedDB records from Chromium profiles, expanding artifact recovery beyond traditional browser databases.
   • Switches cache parsing to use the ccl_chromium_reader library, improving cache artifact coverage.
   • Adds Windows 11 default Chrome profile path and a generic mechanism to locate profiles via inputs_selector.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !In a URLItem, the url_id property is replaced with visit_id; any downstream scripts or plugins referencing url_id will break.
   • !Login data parsing switches from the action_url column to origin_url; tooling that relied on the action_url field in Hindsight output will need to be updated.
6. v2023.03 Mar 29, 2023 · release notes

   Hindsight v2023.03 adds Session Storage records to SQLite output and updates Chrome version support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2023.03 https://github.com/RyanDFIR/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2023.03

7. v2021.12 Dec 16, 2021 · release notes

   Hindsight v2021.12 adds parsing for Chrome Session Storage, TransportSecurity (HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks.), and new Site Setting record types.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2021.12 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2021.12

   • TransportSecurity file now parsed for HSTS settings
   • Session Storage records are now parsed
   • New Site Setting record type exposes site-specific preferences (zoom, mute, hsts, etc.)
   • Preference items expanded: network_prediction_options, password_manager, sessions.event_log, and sync settings

   4 details in Everything

8. v2021.04.26 Apr 27, 2021 · release notes

   Hindsight v2021.04.26 adds Site Characteristics Database parsing and an Unfurl plugin for Local Storage

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2021.04.26 https://github.com/obsidianforensics/hindsight.git
   # already have the repo? check out this version:
   $ git checkout v2021.04.26

   • Parse Site Characteristics Database LevelDB
   • Add plugin to run Unfurl across Local Storage values
   • Add support for Chrome 88 - 90

   3 details in Everything

9. 2021.01.16 Jan 18, 2021 · release notes

   Hindsight 2021.01.16 adds Web UI with SQL-like interface, LevelDB deletion recovery, Chrome 84-87 support and new Media History parsing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2021.01.16 https://github.com/RyanDFIR/hindsight.git
   # already have the repo? check out this version:
   $ git checkout 2021.01.16

   • Add ability to view results of parsing in the Hindsight web UI, using a SQL-like interface
   • Switch to using CCL Forensics' LevelDB parsing code; makes parsing use less dependencies & allows recovery of some deleted records
   • Add parsing of new Media History database
   • Parse additional login items using the stats table
   • Improve Bookmarks parsing to include synced bookmarks

   +2 more show less

   • Add flag (enabled by default) for copying SQLite databases to a temp directory before opening them
   • Change default logging & output directories to be the current working directory

   7 details in Everything

10. v2.4.0 Aug 1, 2019 · release notes

    Hindsight v2.4.0 adds JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output format compatible with Timesketch and expands Chrome support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/obsidianforensics/hindsight.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ USE IT
    Export Chrome history analysis in a streamable JSON Lines format for ingestion into Timesketch.
    shell copy

    hindsight --input chrome_history.sqlite --output results.jsonl -f jsonl

11. v2.3.0 Mar 15, 2019 · release notes

    Adds --input directory search for all Chrome profiles and LevelDB Local Storage parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/obsidianforensics/hindsight.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ TRY IT
    Scan all Chrome user profiles in a folder without listing each one individually.
    copy

    $ hindsight -i C:\Users\JohnDoe

    • --input (or -i) now accepts a directory path to automatically search and parse all Chrome profiles contained within it
    • Parses the LevelDB section of Chrome Local Storage

    2 details in Everything

12. v2.0.0 Mar 5, 2017 · release notes

    Hindsight v2.0.0 adds a cross-platform web UI and parses Chrome Cache, Media Cache, Application Cache, and GPUCache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/obsidianforensics/hindsight.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    └──▷ USE IT
    Install the tool on any OS to enable web UI and new cache parsing capabilities.
    shell copy

    pip install pyhindsight

    • Adds pip install pyhindsight as the new standard installation method for all operating systems
    • Introduces a cross-platform web UI accessible via hindsight_gui.exe or Python scripts
    • Enables parsing of Chrome Cache, Media Cache, Application Cache, and GPUCache formats

    3 details in Everything

13. v1.5.0 Nov 15, 2015 · release notes

    Hindsight v1.5.0 debuts a new graphical interface (GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.) for Chrome artifact analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/obsidianforensics/hindsight.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Adds hindsightGUI.exe, a new portable graphical user interfacegraphical user interfaceA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. compiled for Windows, allowing point-and-click analysis of forensic artifacts.
    • Adds support for detecting and parsing Chrome versions 1 through 46, expanding the tool's ability to analyze older browser data.

    2 details in Everything