hindsight is a Python forensics tool that parses and correlates Chrome, Chromium-based, and Firefox web artifacts into a unified timeline for authorized digital forensics and incident response work.
| Tool | RyanDFIR/hindsight — internet history forensics for Google Chrome/Chromium and Mozilla Firefox |
| Category | Digital forensics / web artifact analysis (Python) |
| Primary Use | Extracting and correlating URLs, downloads, cache, cookies, autofill, and Local Storage records from browser profiles into a timeline during authorized DFIR engagements |
| Safe Use | Intended exclusively for authorized forensic examinations — incident response, corporate investigations, and lab analysis of lawfully acquired evidence |
| Telemetry Note | Purely a forensic parser — it is read-only against evidence; defenders benefit directly since its timeline output documents attacker or victim browser activity on collected systems |
hindsight occupies a well-earned niche in the browser-forensics corner of DFIR. Written in Python and licensed under Apache-2.0, it grew from a Chrome history parser into a broader web-artifact analysis engine that now covers the whole Chromium family — Chrome, Edge, Brave, Vivaldi, and even Tor Browser — plus Mozilla Firefox profiles. What distinguishes it from a pile of single-purpose SQLite scripts is the correlation step: once hindsight extracts records from individual files, it fuses them with data from other history sources and lays everything out on a unified timeline. For an examiner staring at a dozen databases inside a profile directory, that consolidation is the actual product.
The artifact coverage described in the README is broad. hindsight parses URLs, download history, cache records, bookmarks, autofill records, saved passwords, browser preferences, installed extensions, HTTP cookies, and Local Storage records — the HTML5-era storage that classic cookie-parsers miss. For Firefox it handles places.sqlite for history visits, bookmarks, and downloads, along with cookies.sqlite and formhistory.sqlite. Firefox support is selected explicitly in the GUI or via -b Firefox on the command line, pointed at a profile directory under AppData\Roaming\Mozilla\Firefox\Profiles. This means both rendering engines in mainstream use can be processed by one tool with consistent output.
Installation is deliberately simple. The core package installs with pip install pyhindsight, plus a companion parser pinned straight from the upstream repository: pip install git+https://github.com/cclgroupltd/ccl_chromium_reader.git. That dependency on cclgroupltd's Chromium reader is architecturally telling — rather than reimplementing Chromium's quirky internal storage formats, hindsight leans on a specialized library for the hard parsing and focuses its own effort on correlation, timeline construction, and reporting. An optional extra, the install-js.sh script, enables a "View SQLite DB in Browser" feature inside the web interface.
The tool ships in two front-ends: a CLI (hindsight.py / hindsight.exe) and a lightweight web UI launched via hindsight_gui.py (or the packaged hindsight_gui.exe) listening on localhost:8080. The GUI is minimal by design — the only required field is "Profile Path", and after clicking Run you land on a results page where the output can be exported to spreadsheet or other formats. For lab environments where examiners bounce between cases, that low-friction workflow matters; there is no database to stand up and no configuration file to maintain.
Command-line usage centers on a handful of flags. -i takes a browser profile path or a parent directory searched recursively for profiles, -o names the output file, and -f selects format among XLSX (default), SQLite, and JSONL. -b forces a browser type per profile — Chrome, Edge, Brave, Vivaldi, Firefox, or Tor, with Chromium as an alias for Chrome — but the smarter default is to omit it and let hindsight auto-detect each profile, which matters when an input directory contains evidence from several browsers. -c points at an external cache directory, which the README notes is the norm on macOS, where Chrome parks its cache outside the profile.
The artifact filtering system is one of the more thoughtful design decisions documented here. --only and --skip accept comma-separated artifact lists, and crucially the names are browser-neutral: history selects both Chrome's History records and Firefox's places.sqlite URL records, so the same invocation works across engines. Names are case-insensitive and tolerant of spaces, underscores, and hyphens — local-storage, local_storage, and "Local Storage" all resolve identically. Group names like user-activity, website-storage, browser-extensions, configuration, and caches bulk-select everything beneath them, and --only and --skip combine, with --skip narrowing --only. For triage on a profile with a multi-gigabyte cache, --skip cache is an obvious first move.
Error handling in the filter layer reflects forensic discipline. A filtered-out artifact is reported as [ skipped ] during the run and recorded in the log, so a report that omits an artifact remains distinguishable from a profile that never contained it — an evidentiary distinction examiners will recognize immediately. Meanwhile an unrecognized artifact name raises an error instead of being silently ignored, which prevents a typo from quietly producing a report covering the wrong scope. That kind of fail-loud behavior is exactly what you want in a tool whose output may end up attached to a formal report. The README also notes that version detection still reads the profile's database schemas regardless of filters, so browser-version findings stay stable.
Timestamp handling gets first-class treatment: -t sets the display timezone applied to timestamps in XLSX output, and -l with --log-level controls logging, with debug recommended when filing bug reports. Logging appends to an existing file rather than truncating it, which preserves a running record across multiple invocations against the same case — a small detail, but one that shows the author thinks in terms of examination workflows rather than one-shot scripts.
The README closes with a table of default Chrome profile paths across platforms, from WinXP's Local Settings\Application Data layout through Vista-through-10 AppData\Local, Linux ~/.config/google-chrome/Default, macOS Library/Application Support, iOS and Android application containers, and ChromeOS /home/user/<GUID> locations. Publishing these paths is genuinely useful reference material: knowing where profiles live across seven platforms is half the battle when triaging images, and the --help output repeats them so they are available at the terminal during an engagement.
With around 1,500 stars and an active main branch, hindsight sits comfortably among the maintained, community-trusted DFIR utilities. Its topic tags — browser-forensics, dfir, chrome, firefox — accurately describe the scope, and the project solicits feature requests through structured GitHub issues. The CONTRIBUTING.md describes two test suites and a browser-profile corpus for end-to-end testing, a strong signal of engineering maturity: parsing Chromium databases whose schema shifts between browser versions is inherently brittle, and regression testing against real profile corpora is how a tool like this stays reliable.
From a defensive standpoint, hindsight is a force multiplier rather than a risk. It reads evidence rather than generating it, and its timeline output routinely answers the questions incident responders care about: what an intruder downloaded, which extensions were installed, what was typed into forms, and which sites were visited around the time of a compromise. For authorized examiners working on lawfully acquired images, corporate IR engagements, or lab research, it converts a scattered set of SQLite files into a defensible, filterable narrative — which is precisely what browser forensics is supposed to deliver.
RyanDFIR/hindsight.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.