Web browser forensics for Google Chrome/Chromium
This is the first release in a while and it's a relatively minor one. It's mainly bug fixes and updating the version detection for Chrome versions that have come out since the last release. I hope to have time to work on a more substantial update in the future, but for now, here's v2023.03!
host
hashes to include domains from cookies by @obsidianforensics in https://github.com/obsidianforensics/hindsight/pull/121
Full Changelog: https://github.com/obsidianforensics/hindsight/compare/v2021.12...v2023.03
pip install pyhindsight
or by downloading/cloning the GitHub repo.Full Changelog: https://github.com/obsidianforensics/hindsight/compare/v2021.04.26...v2021.12
pip install pyhindsight
or by downloading/cloning the GitHub repo.The 2021.04.26 release of Hindsight is here! Check out the blog post or read on for details on the changes:
Both the GUI and command line versions of this release are available as:
pip install pyhindsight
or by downloading/cloning the GitHub repo.The 2021.01.16 release of Hindsight adds some new features, including improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more! Blog post with more info.
Details:
Media History
databasestats
tableBoth the GUI and command line versions of this release are available as:
pip install pyhindsight
or by downloading/cloning the GitHub repo.EDIT: Windows Defender has been flagging the EXEs as malware, presumably because they were packaged with PyInstaller. The Python script versions are not being flagged. If you'd like to build the EXEs from the Python code yourself, all I did was: pyinstaller --distpath .\dist .\spec\hindsight.spec
from the root of the repo.
Hindsight v20200607 is the first Python 3 release. This involved lots of code refactoring and clean-up. Things should generally run better and faster. It also includes support for the newest versions of Chrome and other small fixes.
Both the GUI and command line versions of this release are available as:
pip install pyhindsight
or downloading/cloning the GitHub repo.Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome, and other small fixes.
Both the GUI and command line versions of this release are available as:
Hindsight v2.3.0 adds input path searching, support for newer versions of Chrome, and minor fixes.
Both the GUI and command line versions of this release are available as:
pip install pyhindsight
or downloading/cloning the GitHub repo.Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome.
Both the GUI and command line versions of this release are available as:
Hindsight v2.1.1 is a smaller update, mostly focused on making processing more robust.
Both the GUI and command line versions of this release are available as:
pip install pyhindsight
or downloading/cloning the GitHub repo.Hindsight v2.0.0 brings new features, many of which are focused on ease-of-use. The highlights are:
pip install pyhindsight
First, the web interface (seen below running via hindsight_gui.exe):
For those that prefer the command line interface, that still remains and has been updated to support the new features. Both the web UI and cmdline versions are available either as .py files or as PyInstaller-compiled EXEs (available at the bottom of this page, or in the dist
folder of the main repo).
Hindsight also has been refactored and much of the parsing moved into the new Python package pyhindsight. This also makes installing Hindsight easier; simply run:
pip install pyhindsight
This will install the pyhindsight package (and all relevant dependencies) and place copies of hindsight.py and hindsight_gui.py into the system's scripts directory.
v2 also introduces the ability to parse various Chrome caches: Cache, Media Cache, Application Cache, and GPUCache. The code is largely based off the Chromagnon project by Jean-RĂ©my Bancel (thanks!).