This blog has a new name and a new home. What was dfir.blog is now Hindsight Foundry, at hindsig.ht. With this move, I modernized my website and brought my interrelated projects together.
Over the years, my research (and the blog) have shifted almost exclusively to browser forensics, so the “DFIR” part of the name was feeling off. The open source tools (Hindsight and Unfurl) are what most people know me for. Most of what I write here is about how (and why) those tools get made: the research that led to a feature, or the reasoning behind one. A foundry is where things get made, so “Hindsight Foundry” felt like a good fit.
What’s here
- Blog posts: All the posts from the previous site have moved over, and I’ll keep adding more. You can now also subscribe by email, if you’d prefer to keep up that way.
- Hindsight: A page describing what Hindsight is (an open source browser forensics tool), how it works at a high level, and how to get the free tool.
- Unfurl: The online version of Unfurl, which breaks URLs into their components and visualizes the extracted data as a graph. It’s built for DFIR and OSINT analysts who want every last bit out of a URL.
- Training: I’m building a hands-on browser forensics training course, structured around investigative questions. This is the newest piece and it’s still in progress. More on that soon!
If you have questions, ideas, or a browser artifact you can’t make sense of, I’d like to hear about it. Get in touch.
