https://cybertoolchain.io/tools/hindsight New releases and features in Hindsight, tracked by The Cyber Toolchain. en Wed, 08 Jul 2026 23:33:43 GMT https://github.com/RyanDFIR/hindsight/releases/tag/v2026.06 https://github.com/RyanDFIR/hindsight/releases/tag/v2026.06 Wed, 08 Jul 2026 23:33:43 GMT Hindsight v2026.06 adds full Mozilla Firefox support and expands Chrome extension, download, and Service Worker parsing. • Adds Mozilla Firefox browser support: parses places.sqlite (history, bookmarks, downloads), cookies.sqlite, formhistory.sqlite, permissions.sqlite, logins.json, extensions.json, sessionstore, favicons, cache2, localStorage, IndexedDB, and bounce-tracking/content-blocking databases. • Adds Firefox HSTS pin parsing from SiteSecurityServiceState.bin and forensically relevant preferences from prefs.js. • Adds Firefox bookmark backup parsing from bookmarkbackups/*.jsonlz4, enabling recovery of deleted bookmarks from daily snapshots. • Adds parsing of Service Worker-related data, including Background Fetch, Background Sync, Cache Storage, Content Index, Cookie Store, Notifications, and Payments protobuf artifacts. • Enhances Chrome extension handling: merges data from disk and Secure Preferences, adds a dedicated Extensions worksheet in Excel output, and surfaces detailed permissions and content scripts. • Expands Chrome downloads parsing to include URL chains, MIME types, shared_proto_db download records, and additional metadata fields reflected in XLSX output. • Adds support for parsing and summarizing Chrome Declarative Net Request (DNR) dynamic rules and improves unpacked extension handling. • Adds browser auto-detection and support for Chromium variants including Edge, Brave, Vivaldi, and Tor Browser. • Includes pure-Python Snappy and Mozilla LZ4 (mozLz40) decoders, removing dependencies on python-snappy and python-lz4 for Firefox artifact decompression. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight https://github.com/obsidianforensics/hindsight/releases/tag/v2026.04 https://github.com/obsidianforensics/hindsight/releases/tag/v2026.04 Sat, 02 May 2026 20:04:49 GMT Hindsight v2026.04 adds Chrome session reconstruction, platform notifications parsing, and Knowledge Graph entity resolution. • Adds Chrome session analysis and session reconstruction, surfacing browsing session timelines in XLSX output with a dedicated Sessions tab. • Adds parsing of platform (OS-level) notifications from Chrome using ccl_chromium_reader. • Adds Knowledge Graph entity resolution and category enrichment for Chrome history artifacts. • Adds parsing of additional Chrome cookie fields (`top_frame_site_key`) for richer cookie artifact detail. • Adds support for the `opener_visit` field in Chrome history data to track referral chains between visits. • Adds experimental support for new cache types: DawnCache, DawnWebGPUCache, and DawnGraphiteCache. • Adds an explicit 'Source Item' column in output rows to identify where each artifact was sourced from. • Enhances Chrome IndexedDB processing for Blob artifacts. • Extends Chrome version support up to version 145. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight https://github.com/obsidianforensics/hindsight/releases/tag/v2026.01 https://github.com/obsidianforensics/hindsight/releases/tag/v2026.01 Fri, 30 Jan 2026 19:16:48 GMT Hindsight v2026.01 adds Chrome Sync Data parsing, permission_actions extraction, Login Data For Account support, and a richer CLI UI. • Adds parsing of Chrome Sync Data, including originator GUIDs and simplified labels for sync records. • Adds parsing of `permission_actions` from the Chrome Preferences file. • Adds support for parsing the 'Login Data For Account' database in Chrome. • Adds translation of `accountcapabilities` from Preferences to human-readable values. • Introduces the `rich` library for improved CLI UI/UX and artifact processing output. • Expands JSONL output with parsing for Chrome IndexedDB, Extension Storage, Sync Data, and Installed Extensions record types. • Improves SQLite output to be comparable to XLSX and JSONL outputs. • Adds updated parsing for changes to DIPS introduced in Chrome v142. • Adds new `danger_type` and `interrupt_reason` codes for download artifact analysis. • Adds generic parsing for simple preference timestamp values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight https://github.com/obsidianforensics/hindsight/releases/tag/v2024.10 https://github.com/obsidianforensics/hindsight/releases/tag/v2024.10 Mon, 04 Nov 2024 14:58:40 GMT Hindsight v2024.10 adds DIPS database parsing, IndexedDB record parsing, and Windows 11 profile path support. • Parses the DIPS (Detect Incidental Party State) database, including new columns and the `popups` table, exposing Chrome's third-party cookie interaction tracking. • Parses IndexedDB records from Chromium profiles, expanding artifact recovery beyond traditional browser databases. • Switches cache parsing to use the `ccl_chromium_reader` library, improving cache artifact coverage. • Adds Windows 11 default Chrome profile path and a generic mechanism to locate profiles via `inputs_selector`. Breaking changes: • In a `URLItem`, the `url_id` property is replaced with `visit_id`; any downstream scripts or plugins referencing `url_id` will break. • Login data parsing switches from the `action_url` column to `origin_url`; tooling that relied on the `action_url` field in Hindsight output will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight https://github.com/RyanDFIR/hindsight/releases/tag/v2023.03 https://github.com/RyanDFIR/hindsight/releases/tag/v2023.03 Wed, 29 Mar 2023 23:41:39 GMT Hindsight v2023.03 adds Session Storage records to SQLite output and updates Chrome version support • `Session Storage` records are now included in the SQLite output format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight https://github.com/obsidianforensics/hindsight/releases/tag/v2021.12 https://github.com/obsidianforensics/hindsight/releases/tag/v2021.12 Thu, 16 Dec 2021 23:25:08 GMT Hindsight v2021.12 adds parsing for Chrome Session Storage, TransportSecurity (HSTS), and new Site Setting record types. • `TransportSecurity` file now parsed for HSTS settings • Session Storage records are now parsed • New `Site Setting` record type exposes site-specific preferences (zoom, mute, hsts, etc.) • Preference items expanded: `network_prediction_options`, `password_manager`, `sessions.event_log`, and sync settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hindsight