Hindsight is a free software tool designed to analyze web browser artifacts, particularly for Google Chrome and Chromium-based applications. It enables users to extract, parse, and visualize various types of web-related data, including URLs, download history, cache records, bookmarks, autofill entries, saved passwords, preferences, extensions, HTTP cookies, and Local Storage records.
Key Features:
Artifact Parsing: Hindsight supports the extraction and analysis of multiple types of browser artifacts, providing a comprehensive view of user activity.
Timeline Correlation: Extracted data is correlated across different history files and organized into a timeline for easier analysis.
User-Friendly Web Interface: A simple web UI allows users to interact with the tool by specifying input paths and viewing results, accessible via http://localhost:8080.
Command-Line Support: Hindsight includes a command-line version (hindsight.py or hindsight.exe) for automated workflows.
Cross-Platform Compatibility: The tool supports analysis across multiple operating systems, including Windows, Linux, macOS, iOS, Android, and ChromeOS.
Output Formats: Results can be exported to various formats such as XLSX, SQLite, and JSONL.
Audience & Benefit:
Ideal for digital forensics investigators, incident responders, cybersecurity professionals, and researchers, Hindsight provides actionable insights into user activity on web browsers. It helps identify patterns, detect anomalies, and uncover potential security threats by analyzing browser artifacts. Users can gain a detailed understanding of browsing behavior and use the tool to support forensic investigations or enhance security measures.
README
Hindsight
Internet history forensics for Google Chrome/Chromium
Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!). Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.
It has a simple web UI - to start it, run "hindsight_gui.py" (or on Windows, the packaged "hindsight_gui.exe") and visit http://localhost:8080 in a browser:
The only field you are required to complete is "Profile Path". This is the location of the Chrome profile you want to analyze (the default profile paths for different OSes is listed at the bottom of this page). Click "Run" and you'll be taken to the results page in where you can save the results to a spreadsheet (or other formats).
Manual Installation
To install Hindsight (both the command line tool and the web interface), do:
If you'd like to use the "View SQLite DB in Browser" feature in the Hindsight web interface, you'll need to run another install command:
curl -sSL https://raw.githubusercontent.com/obsidianforensics/hindsight/master/install-js.sh | sh
Command Line
There also is command line version of Hindsight - hindsight.py or hindsight.exe. The user guide in the documentation folder covers many topics, but the info below should get you started with the command line version:
Example usage: > C:\hindsight.py -i "C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default" -o test_case
Command Line Options:
Option
Description
-i or --input
Path to the Chrome(ium) "Default" directory
-o or --output
Name of the output file (without extension)
-f or --format
Output format (default is XLSX, other options are SQLite and JSONL)
Hindsight