Extracting Timestamps from ChatGPT IDs
Since mid-2024, ChatGPT conversation IDs (and more!) have been UUIDv8s with an extractable creation timestamp. This post explains the ID structure and how to extract the timestamp.
Decoding Facebook's fbclid
Newer fbclid values contain extractable click timestamps, a browser ID, the source app, and more.
Parsers for Gmail, Outlook Safe Links, Social Media IDs added in Unfurl
Unfurl v2026.09 adds parsers for Gmail, Safe Links, Facebook, Instagram, and GitHub, decodes more timestamps in tokens and IDs, and gives the web UI new Tree and Text views.
Introducing Hindsight Foundry
dfir.blog is now Hindsight Foundry: a site dedicated to browser forensics research, open source tools, and related resources.
Hindsight adds Firefox support!
Hindsight now supports Mozilla Firefox! Other new features include parsing Service Worker-related data and parsing additional sources for extensions and downloads.
Hindsight v2026.04 Released!
Hindsight v2026.04 adds parsing of Session files (including form data), platform notifications, & Google Knowledge Graph lookups for page categories and entities!
Hindsight v2026.01 Released!
Hindsight v2026.01 brings new features, including parsing Sync Data, an updated terminal interface, improved output formats, and dozens of fixes and enhancements.
Unfurl 2025.03
Unfurl v2025.03 adds new features, including parsing Google Search's UDM parameter, support for Mastodon forks (like Truth Social), and a utility parser to "clean up" inputs.
Hindsight v2025.03 Released!
Hindsight v2025.03 focuses on Extensions - parsing more activity and state records, highlighting Extension permissions, and making it easier to examine Manifests.
Unfurl v2025.02 Released
Unfurl v2025.02 adds parsing of obfuscated IP addresses, more Bluesky timestamps, and more!
Authenticating Screenshots from Netflix's Carry-On Movie
I watch Netflix's Carry-On, notice a real Google Search URL on screen, extract lots of data points from it and "authenticate" the screenshot.
Video of "What Can DFIQ Do For You?" Posted
The talk "What Can DFIQ Do For You?" that Jon Brown and I gave at the SANS DFIR Summit 2023 has been posted on YouTube!
Unfurl v2023.09 Released!
Unfurl v2023.09 adds parsing for JWTs, URLs with encoded DoH (DNS over HTTPS) requests, and more Mastodon servers.
Unfurl v2022.11: Social Media Edition
This "social media edition" Unfurl release includes parsing Twitter sharing codes, timestamps from Mastodon and LinkedIn IDs, expanding Substack redirects, & more!
More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02
Unfurl v2022.02 adds parsing for Google Search's aqs parameter, integrates MISP "warninglists", adds 3x more shortlink expansions, and more!
Hindsight v2021.12
Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more!
Cookies Database Moving in Chrome 96
To support stronger security for Chrome, some network-related files - including the Cookies database - are moving locations on disk.
Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15
A new Unfurl release is here! v2021.06.15 adds decoding of some Metasploit URLs, hash identification and API lookups, & more!
Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight
Hindsight 2021.04.26 has many small improvements and fixes, including support for Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database!
Keystroke Flow from Chrome Omnibox
I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram.
New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!
Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more!
A Year of #DailyDFIR
A look back at a year of tweeting every day about DFIR topics - including a recap of the most popular tweets, coverage trends, and what's next in 2021.
"Cache Up" with Ryan Benson
I sat down with Jessica Hyde (from Magnet Forensics) on her "Cache Up" podcast to talk about my DFIR career, open source projects, and how folks getting into DFIR can find an area to dig into.
New "Media History" File Added to Chrome
There's a new database added in Chrome 86, dedicated to tracking media playback. Here's a first look at its contents!
Unfurl on "Life Has No Ctrl+Alt+Delete"
A few weeks ago I was on "Life Has No Ctrl+Alt+Del" with @HeatherMahalik of Cellebrite giving an overview of Unfurl, how to use it, and walking through (many) examples. The video recording is now up!
Video of "Extract & Visualize Data from URLs using Unfurl" Posted
My talk "Extract and Visualize Data from URLs using Unfurl" at the SANS DFIR Summit 2020 has been posted on YouTube! I had a great time presenting at the first ever virtual DFIR Summit (yay 2020). Che
Tinkering with TikTok Timestamps
I tinker with TikTok - and find a timestamp embedded in video URLs!
New Unfurl Version Released
A new version of Unfurl is here! v20200729 adds improved Google Search URL parsing (RLZ and EI parameters), more short-link expansions, DuckDuckGo search parsing, and mailto link parsing.
Another Google Search Parameter? For RLZ!
The rlz parameter in Google Search URLs isn't as mysterious as many others; Google explains what it is and how it functions in a white paper.
Unfurl CLI version (and now on PyPI)
A new Unfurl version brings a CLI tool & easier installs via PyPI.
Hindsight is 2020
Hindsight is 2020! ... ok, it's actually 20200607, but I've been waiting years to make a bad "Hindsight 2020" joke. There's a new version of Hindsight!
Unfurling Unknown Protobufs
With this latest update, Unfurl can now parse protobufs as well! If you hover over a field, Unfurl tries to explain a bit about wire types and possible other data formats.
Unfurl... in 3D
Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!
Google "ved" Parameter Versions
The "ved" parameter in Google URLs contains valuable link context. I've found a new version ("v2") with more info!
Talking about Unfurl on the Forensic Lunch
Ryan Benson on Dave Cowen's Forensic Lunch talking about Unfurl (and other DFIR things).
Introducing Unfurl
Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured.
Deciphering Browser Hieroglyphics: FileSystem (Part 3)
Part 3 in the Deciphering Browser Hieroglyphics series examines LevelDB databases and Chrome's FileSystem.
Deciphering Browser Hieroglyphics: LocalStorage (Part 2)
The second post in "Deciphering Browser Hieroglyphics" discusses LocalStorage and using CyberChef to decode it.
Hindsight v2.4 Adds JSONL Output
Hindsight v2.4.0 adds JSONL output, support for the newest versions of Chrome (1-76), and other small fixes.
Deciphering Browser Hieroglyphics: Intro (Part 1)
In this first post in "Deciphering Browser Hieroglyphics" I introduce Chromotopia and our artifact deciphering approach.
Solving Magnet Forensics CTF with Plaso, Timesketch, and Colab
I took a crack at the Magnet Forensics CTF using the open source tools we use/build here at Google: Plaso, Timesketch, and Colab/Python.
A First Look at Chromium-Based Edge
A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome.
Hindsight v2.3 Finds and Parses Multiple Chrome Profiles
Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes.
Chrome Values Lookup Tables
I've fielded a few questions recently about what some value buried in a Chrome artifact means, so I'm putting some of the value tables I look up often here on this page.
Capturing Chrome's Evolution
As part of keeping Hindsight up to date, I started documenting the database structures for each version of Chrome as it was released.
New Year, New dfir.blog
2019 is here and the new year brings something with it I've wanted to do for a while: re-launch my blog! It has a new look and a new home at dfir.blog.
Hindsight
Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications.
Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018
I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. SANS recently posted the recording; enjoy!
Ryan Benson Interviewed by BBC Click about Web Browsers
I was interviewed by BBC Click for their "What is GDPR?" episode and got to talk about browser forensics on TV.
Hindsight v2.2 Parses More Chrome Preference Items
Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome (1 - 66).
Deciphering Browser Hieroglyphics
I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using a variety of
Visualizing Activity from Metadata
Encrypted iPhone backup? That means it's useless to an investigator (or attacker), right? Not so fast. We can still get an incredible amount of insight from the metadata alone.
Hindsight v2 Adds a Web UI and Cache Parsing
Hindsight v2 is here! The new release brings new features, many of which are focused on ease-of-use, along with a refactoring of the code into a Python package pyhindsight.
Investigating Universal Analytics
Two common questions when investigating web browsing are: (1) how long did a user spend on a website, and (2) what actions did they take while on it?
Load Balancer Cookie Decoder
I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies.
Alexa, Tell Me Your Secrets
The Amazon Echo is a nifty little device that you communicate with via speech. The forensic investigator side of me was very interested in what potential artifacts it could create.
It's a "Brave" New World... or is it?
Brave is a new browser from some experienced people that aims to be faster and safer than other browsers by blocking ads and trackers.
Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015
I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for extracting, in
Finding the First Thread with a Visualization
Finding the first thread to pull to get an investigation started can sometimes be difficult. Having a checklist and a structured approach to your investigation can help quite a bit.
Upgrading Python's SQLite
I've run across a problem using Python with newer SQLite databases, and I thought I'd share a solution to hopefully save people some time and frustration getting things working.
Hindsight v1.5.0 released + GUI!
I am very excited to announce that Hindsight v1.5.0 is here! The major change is that there is now a graphic interface available for Hindsight.
Featured on Autopsy Blog
I spoke with Basis Technology about my background and SQUID (SQLite Unknown Identifier), a new tool I'm releasing at OSDFCon that finds exact and near matches of SQLite databases.
Visualizing USN Journal Activity
Since learning about the USN journal, my investigative process has never been the same. It is a powerful artifact that can tell us much about what has transpired on a system.
The Chrome history was cleared! Now what? (part 1)
Let's assume the Chrome history was cleared. That totally wipes out all traces of any browsing activity. Right? Well, not so fast...
The Chrome history was cleared! Now what? (part 0)
Why do you think that the Chrome history had been cleared? No records, gaps in the entries, or records that stop abruptly each have explanations besides "the user cleared their history".
It's All About Time - Hindsight v1.4 Released
Hindsight v1.4.0 is here and it has a number of improvements, all involving time.
Chrome Transition Values
Most articles on the Chrome transition values focus on the meaning of the decoded value; here I'll walk through how to actually do the decoding.
Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging
Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging.
Archived History files removed from Chrome v37
Chrome v37 brings the end of the 'Archived History' database, meaning Chrome no longer keeps URL visit records older than three months.
Hindsight v1.1.0 Adds SQLite and JSON Outputs
Hindsight v1.1.0 is live! The biggest news is that Hindsight can now output to JSON and SQLite in addition to the original XLSX format.
Chrome Databases Reference Chart Updated to Chrome v35
Chrome updated to version 35 a few days ago, and I'm releasing an updated version of my "Evolution of Chrome Databases Reference Chart" to cover those new versions.
Python version of Hindsight Released
Today I am releasing a Python version of Hindsight (a Google Chrome forensics tool), ported from the original Perl version.
The Evolution of Chrome Databases Reference Chart
Chrome's rapid release cycle can be a bit of a pain for tool developers like me, so I decided I needed controlled samples of Chrome SQLite databases from each version of Chrome.
Hindsight v0.84 Released
An update to Hindsight is now available! The new version (0.84) has some bug fixes and increased functionality (specifically regarding download records).
History Index files removed from Chrome v30
Chrome v30 came with some bad news for forensicators: the History Index files, which had the text content of most websites a user visited, are no more.
Detecting Clock Changes Using Cookies
The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic.
Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)
A new version (0.83) of Hindsight is now available. Chrome changed how it saves download records as of version 26, and this release accounts for that.
Hindsight Adds Parsing of Chrome Preferences file
After reading Jesse Kornblum's post on Chrome privacy issues, I incorporated some of the valuable information in the Chrome Preferences file into the report Hindsight produces.
Announcing Hindsight: A Free Chrome Forensics Tool
Hindsight is a free tool for extracting, interpreting, and reporting on Google Chrome artifacts, including URLs, download history, autofill records, cookies, and Local Storage records.
Deleted File Recovery using foremost
In this post, we'll use the Linux program foremost to recover files, both existing and deleted, from a .dd image. foremost is what is known as a data-carving utility.
Slack Space
Slack space can exist when a file's size is not a multiple of the file system's cluster size.
Imaging Using dcfldd
In this post, a 128MB USB thumb drive will be imaged on a Linux system using dcfldd, an improved version of dd.
No posts found for this tag