hindsight v2021.12 releases: Internet history forensics for Google Chrome/Chromium
Hindsight
Internet history forensics for Google Chrome/Chromium
Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!). Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.
It has a simple web UI – to start it, run “hindsight_gui.py” (or on Windows, the packaged “hindsight_gui.exe”) and visit http://localhost:8080 in a browser:
The only field you are required to complete is “Profile Path”. This is the location of the Chrome profile you want to analyze (the default profile paths for different OSes is listed at the bottom of this page). Click “Run” and you’ll be taken to the results page in where you can save the results to a spreadsheet (or other formats).
Default Profile Paths
The Chrome default profile folder default locations are:
- WinXP: [userdir]\Local Settings\Application Data\Google\Chrome\User Data\Default
- Vista/7/8: [userdir]\AppData\Local\Google\Chrome\User Data\Default
- Linux: [userdir]/.config/google-chrome/Default
- OS X: [userdir]/Library/Application Support/Google/Chrome/Default
- iOS: \Applications\com.google.chrome.ios\Library\Application Support\Google\Chrome\Default
- Android: /userdata/data/com.android.chrome/app_chrome/Default
Changelog v2021.12
🚀 Features
- Support for Chrome 91-96 by @obsidianforensics in #107, #117
- Add parsing of TransportSecurity file (HSTS settings).
- Add parsing of Session Storage #102
- Adds new “Site Setting” record type, which includes settings and preferences that are site-specific, including zoom, mute, hsts, engagement, and potentially more. #100
- More parsing of Preference items: network_prediction_options, password_manager, sessions.event_log, and sync settings. #101
🛠️ Minor Changes & Fixes
- Fix for case with missing Brave version by @cteodor in #99
- Update embedded ccl_chromium_indexeddb by @obsidianforensics in #102
- Timestamp sorting bug caused by incorrectly interpreting microsecond timestamps by @obsidianforensics in #103
- When searching for Profiles, don’t follow symlinks (reports of loops,… by @obsidianforensics in #104
- Add try/except around reading Session Storage records in case of Leve… by @obsidianforensics in #106
- Two small quality of life improvements by @kumavis in #111
- chmod +x hindsight_gui.py by @kumavis in #112
- Report analysis session error by @kumavis in #113
- Add support for new Network subdirectory and files moved within it by @obsidianforensics in #116
Use
hindsight_gui.py
Download
Copyright 2015 Ryan Benson
