Open source DFIR tools for digital forensics and incident response. Home of Hindsight (browser forensics) and Unfurl (URL analysis). https://hindsig.ht en-us Fri, 25 Sep 2026 14:29:59 GMT https://hindsig.ht/blog/unfurl-parses-gmail-safe-links-and-social-media-ids/ https://hindsig.ht/blog/unfurl-parses-gmail-safe-links-and-social-media-ids/ Unfurl v2026.09 adds parsers for Gmail, Safe Links, Facebook, Instagram, and GitHub, decodes more timestamps in tokens and IDs, and gives the web UI new Tree and Text views. Fri, 25 Sep 2026 00:00:00 GMT Ryan Benson Unfurl https://hindsig.ht/blog/introducing-hindsight-foundry/ https://hindsig.ht/blog/introducing-hindsight-foundry/ dfir.blog is now Hindsight Foundry: a site dedicated to browser forensics research, open source tools, and related resources. Fri, 18 Sep 2026 00:00:00 GMT Ryan Benson Digital Forensics Open Source Tools Hindsight Unfurl https://hindsig.ht/blog/hindsight-parses-firefox/ 6a4c08e8b428e5160d546a8c Hindsight now supports Mozilla Firefox! Other new features include parsing Service Worker-related data and parsing additional sources for extensions and downloads. Wed, 08 Jul 2026 00:00:00 GMT Ryan Benson Hindsight Chrome Firefox Web Browsers https://hindsig.ht/blog/hindsight-parses-sessions-and-notifications/ 69f4e215b428e5160d5469ce Hindsight v2026.04 adds parsing of Session files (including form data), platform notifications, & Google Knowledge Graph lookups for page categories and entities! Sat, 02 May 2026 00:00:00 GMT Ryan Benson Hindsight Chrome Open Source Tools https://hindsig.ht/blog/hindsight-v2026-01/ 69821bfc04abfd293590e01b Hindsight v2026.01 brings new features, including parsing Sync Data, an updated terminal interface, improved output formats, and dozens of fixes and enhancements. Wed, 04 Feb 2026 00:00:00 GMT Ryan Benson Hindsight Chrome Open Source Tools https://hindsig.ht/blog/unfurl-parses-googe-udm-and-truth-social/ 67d1001404abfd293590df33 Unfurl v2025.03 adds new features, including parsing Google Search's UDM parameter, support for Mastodon forks (like Truth Social), and a utility parser to "clean up" inputs. Thu, 13 Mar 2025 00:00:00 GMT Ryan Benson Unfurl https://hindsig.ht/blog/hindsight-parses-browser-extensions/ 67cf125f04abfd293590deba Hindsight v2025.03 focuses on Extensions - parsing more activity and state records, highlighting Extension permissions, and making it easier to examine Manifests. Tue, 11 Mar 2025 00:00:00 GMT Ryan Benson Hindsight Web Browsers Chrome https://hindsig.ht/blog/unfurl-parses-obfuscated-ip-addresses/ 67b1f90804abfd293590de21 Unfurl v2025.02 adds parsing of obfuscated IP addresses, more Bluesky timestamps, and more! Wed, 19 Feb 2025 00:00:00 GMT Ryan Benson Unfurl https://hindsig.ht/blog/authenticating-screenshots-from-netflix-carry-on-movie/ 677b39a704abfd293590dbca I watch Netflix's Carry-On, notice a real Google Search URL on screen, extract lots of data points from it and "authenticate" the screenshot. Mon, 13 Jan 2025 00:00:00 GMT Ryan Benson Unfurl Web Browsers https://hindsig.ht/blog/dfiq-video-at-sans-dfir-summit-2023/ 6765afa704abfd293590dbae The talk "What Can DFIQ Do For You?" that Jon Brown and I gave at the SANS DFIR Summit 2023 has been posted on YouTube! Wed, 20 Dec 2023 00:00:00 GMT Ryan Benson Presentations and Interviews Open Source Tools https://hindsig.ht/blog/unfurl-parsing-jwt-and-doh/ 66579e6f04abfd293590d980 Unfurl v2023.09 adds parsing for JWTs, URLs with encoded DoH (DNS over HTTPS) requests, and more Mastodon servers. Wed, 27 Sep 2023 00:00:00 GMT Ryan Benson Unfurl Open Source Tools https://hindsig.ht/blog/unfurl-parsing-twitter-mastodon-linkedin/ 66579e6f04abfd293590d97e This "social media edition" Unfurl release includes parsing Twitter sharing codes, timestamps from Mastodon and LinkedIn IDs, expanding Substack redirects, & more! Thu, 10 Nov 2022 00:00:00 GMT Ryan Benson Unfurl https://hindsig.ht/blog/search-parsing-and-misp-lists-in-unfurl/ 66579e6f04abfd293590d97d Unfurl v2022.02 adds parsing for Google Search's aqs parameter, integrates MISP "warninglists", adds 3x more shortlink expansions, and more! Wed, 02 Mar 2022 00:00:00 GMT Ryan Benson Unfurl Open Source Tools https://hindsig.ht/blog/hindsight-v2021-12/ 66579e6f04abfd293590d97b Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more! Tue, 21 Dec 2021 00:00:00 GMT Ryan Benson Hindsight Open Source Tools Chrome Web Browsers https://hindsig.ht/blog/cookies-database-moving-in-chrome-96/ 66579e6f04abfd293590d97a To support stronger security for Chrome, some network-related files - including the Cookies database - are moving locations on disk. Thu, 16 Dec 2021 00:00:00 GMT Ryan Benson Chrome Web Browsers https://hindsig.ht/blog/metasploit-urls-and-hash-lookups-in-unfurl/ 66579e6f04abfd293590d979 A new Unfurl release is here! v2021.06.15 adds decoding of some Metasploit URLs, hash identification and API lookups, & more! Tue, 15 Jun 2021 00:00:00 GMT Ryan Benson Unfurl Open Source Tools https://hindsig.ht/blog/unfurl-plugin-and-site-characteristics-database-added-to-hindsight/ 66579e6f04abfd293590d978 I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plu Wed, 28 Apr 2021 00:00:00 GMT Ryan Benson Hindsight Digital Forensics Chrome Unfurl Python Open Source Tools https://hindsig.ht/blog/keystroke-flow-from-chrome-omnibox/ 66579e6f04abfd293590d977 I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram. Thu, 18 Feb 2021 00:00:00 GMT Ryan Benson Visualizations Chrome Web Browsers Open Source Tools Digital Forensics https://hindsig.ht/blog/hindsight-better-leveldb-and-new-web-ui/ 66579e6f04abfd293590d975 Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more! Mon, 18 Jan 2021 00:00:00 GMT Ryan Benson Hindsight Open Source Tools Python Web Browsers Chrome https://hindsig.ht/blog/a-year-of-dailydfir/ 66579e6f04abfd293590d976 A look back at a year of tweeting every day about DFIR topics - including a recap of the most popular tweets, coverage trends, and what's next in 2021. Thu, 31 Dec 2020 00:00:00 GMT Ryan Benson Digital Forensics Presentations and Interviews https://hindsig.ht/blog/cache-up-with-ryan-benson/ 66579e6f04abfd293590d973 I sat down with Jessica Hyde (from Magnet Forensics) on her "Cache Up" podcast and talked about my DFIR career, open source projects, and share thoughts on how folks can get started in DFIR. Check ... Wed, 28 Oct 2020 00:00:00 GMT Ryan Benson Presentations and Interviews https://hindsig.ht/blog/media-history-database-added-to-chrome/ 66579e6f04abfd293590d971 There's a new database added in Chrome 86, dedicated to tracking media playback. Here's a first look at its contents! Tue, 13 Oct 2020 00:00:00 GMT Ryan Benson Chrome Web Browsers Digital Forensics https://hindsig.ht/blog/unfurl-on-ctrl-alt-delete/ 66579e6f04abfd293590d972 A few weeks ago I was on "Life Has No Ctrl+Alt+Del" with @HeatherMahalik of Cellebrite giving an overview of Unfurl, how to use it, and walking through (many) examples. The video recording is now up! Mon, 28 Sep 2020 00:00:00 GMT Ryan Benson Presentations and Interviews Unfurl https://hindsig.ht/blog/unfurl-video-at-sans-dfir-summit-2020/ 66579e6f04abfd293590d970 My talk "Extract and Visualize Data from URLs using Unfurl" at the SANS DFIR Summit 2020 has been posted on YouTube! I had a great time presenting at the first ever virtual DFIR Summit (yay 2020). Che Sun, 20 Sep 2020 00:00:00 GMT Ryan Benson Presentations and Interviews https://hindsig.ht/blog/tinkering-with-tiktok-timestamps/ 66579e6f04abfd293590d96f I tinker with TikTok - and find a timestamp embedded in video URLs! Tue, 11 Aug 2020 00:00:00 GMT Ryan Benson Digital Forensics Unfurl Open Source Tools https://hindsig.ht/blog/new-unfurl-adds-rlz-shortlink-mailto-parsing/ 66579e6f04abfd293590d96e A new version of Unfurl is here! v20200729 adds: improved Google Search URL parsing (RLZ and EI parameters), more short-link expansions, DuckDuckGo search parsing, mailto link parsing, and a better... Wed, 05 Aug 2020 00:00:00 GMT Ryan Benson Unfurl Open Source Tools https://hindsig.ht/blog/google-search-rlz/ 66579e6f04abfd293590d96d There are many query string parameters in Google Search URLs that hold interesting information. The rlz parameter is no exception, but thankfully it isn't as mysterious as many others; Google explains Thu, 30 Jul 2020 00:00:00 GMT Ryan Benson Python Unfurl https://hindsig.ht/blog/unfurl-cli-version-now-on-pypi/ 66579e6f04abfd293590d96c A new Unfurl version brings a CLI tool & easier installs via PyPI. Tue, 30 Jun 2020 00:00:00 GMT Ryan Benson Unfurl Open Source Tools Digital Forensics Python https://hindsig.ht/blog/hindsight-is-2020/ 66579e6f04abfd293590d96b Hindsight is 2020! ... ok, it's actually 20200607, but I've been waiting years to make a bad "Hindsight 2020" joke. There's a new version of Hindsight! Wed, 10 Jun 2020 00:00:00 GMT Ryan Benson Hindsight Open Source Tools Python Chrome https://hindsig.ht/blog/unfurling-unknown-protobufs/ 66579e6f04abfd293590d96a With this latest update, Unfurl can now parse protobufs as well! If you hover over a field, Unfurl tries to explain a bit about wire types and possible other data formats. Wed, 08 Apr 2020 00:00:00 GMT Ryan Benson Digital Forensics Open Source Tools Python Unfurl https://hindsig.ht/blog/unfurl-in-3d/ 66579e6f04abfd293590d969 Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that! Wed, 01 Apr 2020 00:00:00 GMT Ryan Benson Visualizations Open Source Tools Digital Forensics Web Browsers Unfurl https://hindsig.ht/blog/google-ved-versions/ 66579e6f04abfd293590d966 The "ved" parameter in Google URLs contains valuable link context. I've found a new version ("v2") with more info! Thu, 27 Feb 2020 00:00:00 GMT Ryan Benson Web Browsers Digital Forensics https://hindsig.ht/blog/talking-about-unfurl-on-the-forensic-lunch/ 66579e6f04abfd293590d965 Ryan Benson on Dave Cowen's Forensic Lunch talking about Unfurl (and other DFIR things). Fri, 24 Jan 2020 00:00:00 GMT Ryan Benson Presentations and Interviews Open Source Tools Unfurl https://hindsig.ht/blog/introducing-unfurl/ 66579e6f04abfd293590d962 Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL up into components, e Thu, 12 Dec 2019 00:00:00 GMT Ryan Benson Open Source Tools Visualizations Web Browsers Unfurl https://hindsig.ht/blog/deciphering-browser-hieroglyphics-leveldb-filesystem/ 66579e6f04abfd293590d95e Part 3 in the Deciphering Browser Hieroglyphics series examines LevelDB databases and Chrome's FileSystem. Thu, 08 Aug 2019 00:00:00 GMT Ryan Benson Web Browsers Chrome https://hindsig.ht/blog/deciphering-browser-hieroglyphics-localstorage/ 66579e6f04abfd293590d95d The second post in "Deciphering Browser Hieroglyphics" discusses LocalStorage and using CyberChef to decode it. Fri, 02 Aug 2019 00:00:00 GMT Ryan Benson Web Browsers Chrome https://hindsig.ht/blog/hindsight-v2-4-adds-jsonl-output/ 66579e6f04abfd293590d95a Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome (1-76), and other small fixes. Thu, 01 Aug 2019 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Web Browsers Chrome Python https://hindsig.ht/blog/deciphering-browser-hieroglyphics-intro/ 66579e6f04abfd293590d935 In this first post in "Deciphering Browser Hieroglyphics" I introduce Chromotopia and our artifact deciphering approach. Mon, 22 Jul 2019 00:00:00 GMT Ryan Benson Web Browsers Chrome https://hindsig.ht/blog/solving-magnet-forensics-ctf-with-plaso-timesketch-colab/ 66579e6f04abfd293590d959 The folks at Magnet Forensics had a digital forensics-themed Capture the Flag competition and I wanted to take a crack at it using the open source tools we use/build here at Google: Plaso, Timesket... Tue, 23 Apr 2019 00:00:00 GMT Ryan Benson Open Source Tools Digital Forensics https://hindsig.ht/blog/a-first-look-at-chromium-based-edge/ 66579e6f04abfd293590d958 A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome. Tue, 09 Apr 2019 00:00:00 GMT Ryan Benson Web Browsers Digital Forensics Hindsight https://hindsig.ht/blog/hindsight-v2-3-find-parse-multiple-chrome-profiles/ 66579e6f04abfd293590d956 Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes. Fri, 15 Mar 2019 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Web Browsers Python Chrome https://hindsig.ht/blog/chrome-values-lookup-tables/ 66579e6f04abfd293590d954 I've fielded a few questions recently about what some value buried in a Chrome artifact means. I find myself going to the Hindsight source on GitHub and drilling down into the code because I know I ha Thu, 28 Feb 2019 00:00:00 GMT Ryan Benson Web Browsers Chrome Digital Forensics https://hindsig.ht/blog/capturing-chromes-evolution/ 66579e6f04abfd293590d953 When I was pretty fresh in the field of digital forensics, I picked this new thing called Google Chrome to dig into. There weren't a lot of tools out there that could parse it and I thought learning a Wed, 20 Feb 2019 00:00:00 GMT Ryan Benson Chrome Visualizations Web Browsers Sqlite Open Source Tools https://hindsig.ht/blog/new-year-new-dfir-blog/ 66579e6f04abfd293590d94c 2019 is here and the new year brings something with it I've wanted to do for a while: re-launch my blog! It has a new look and a new home at dfir.blog. I've had some big changes in my life: I became Mon, 14 Jan 2019 00:00:00 GMT Ryan Benson Digital Forensics https://hindsig.ht/blog/hindsight/ 66579e6f04abfd293590d955 Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications - with more to Tue, 01 Jan 2019 00:00:00 GMT Ryan Benson Open Source Tools Chrome Cookies Digital Forensics Hindsight Web Browsers https://hindsig.ht/blog/efficiently-summarizing-web-browsing-activity/ 66579e6f04abfd293590d94e I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. My abstract was: Reviewing web browsing activity is relevant in a wide variety of DFIR cases. Wi Fri, 07 Dec 2018 00:00:00 GMT Ryan Benson Presentations and Interviews Digital Forensics Web Browsers Visualizations Open Source Tools Chrome https://hindsig.ht/blog/ryan-benson-bbc-click-interview-web-browsers/ 66579e6f04abfd293590d93f I was interviewed by BBC Click for their "What is GDPR?" episode. I'm not really sure what the personal information web browsers are storing on your computer has to do with the GDPR, but hey, I got to Wed, 23 May 2018 00:00:00 GMT Ryan Benson Presentations and Interviews Web Browsers Chrome https://hindsig.ht/blog/hindsight-v2-2-more-chrome-preference-items/ 66579e6f04abfd293590d92e Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome. The quick version is: * Support for Chrome versions 1 - 66 * Preference items with timestamps now ar Fri, 04 May 2018 00:00:00 GMT Ryan Benson Open Source Tools Web Browsers Hindsight Chrome https://hindsig.ht/blog/deciphering-browser-hieroglyphics/ 66579e6f04abfd293590d94f I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using a variety of Wed, 20 Sep 2017 00:00:00 GMT Ryan Benson Presentations and Interviews Chrome Digital Forensics Hindsight Open Source Tools Web Browsers https://hindsig.ht/blog/visualizing-activity-from-metadata/ 66579e6f04abfd293590d92d Encrypted iPhone backup? That means it's useless to an investigator (or attacker), right? Not so fast. We can still get an incredible amount of insight into the actions on the devices from the metadat Thu, 29 Jun 2017 00:00:00 GMT Ryan Benson Visualizations Digital Forensics Open Source Tools https://hindsig.ht/blog/hindsight-v2-adds-web-ui-and-cache-parsing/ 66579e6f04abfd293590d92f Hindsight v2 is here! The new release brings new features, many of which are focused on ease-of-use, along with a refactoring of the code into a Python package pyhindsight. The highlights are: * Cro Wed, 08 Mar 2017 00:00:00 GMT Ryan Benson Open Source Tools Web Browsers Hindsight Chrome https://hindsig.ht/blog/investigating-universal-analytics/ 66579e6f04abfd293590d930 Two common questions when investigating web browsing are: (1) how long did a user spend on a website, and (2) what actions did they take while on it? We have a number of methods of approximating what Fri, 16 Dec 2016 00:00:00 GMT Ryan Benson Web Browsers Digital Forensics https://hindsig.ht/blog/load-balancer-cookie-decoder/ 66579e6f04abfd293590d931 I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies. Adam Maxwell (@catalyst256) wrote a few blog posts describing his process of fig Thu, 23 Jun 2016 00:00:00 GMT Ryan Benson Web Browsers Hindsight Cookies Open Source Tools https://hindsig.ht/blog/alexa-tell-me-your-secrets/ 66579e6f04abfd293590d932 The Amazon Echo is a nifty little device that you communicate with via speech - you can ask it to do various tasks and it verbally replies. You preface each command with the trigger word - either "Ale Mon, 06 Jun 2016 00:00:00 GMT Ryan Benson Open Source Tools Digital Forensics Sqlite https://hindsig.ht/blog/its-a-brave-new-world-or-is-it/ 66579e6f04abfd293590d933 Brave is a new browser from some experienced people that aims to be faster and safer than other browsers by blocking ads and trackers. Brave also wants to disrupt the current online model where users Fri, 18 Mar 2016 00:00:00 GMT Ryan Benson Web Browsers Brave Digital Forensics https://hindsig.ht/blog/customized-google-chrome-forensics-with-python-sans-dfir-summit-2015/ 66579e6f04abfd293590d94d I spoke at the SANS DFIR Summit 2015 on "Customized Google Chrome Forensics with Python" in Austin, TX. My presentation introduced Hindsight, an open source tool (written in Python) for extracting, in Fri, 11 Dec 2015 00:00:00 GMT Ryan Benson Presentations and Interviews Hindsight Open Source Tools Chrome Web Browsers Digital Forensics https://hindsig.ht/blog/finding-the-first-thread-with-a-visualization/ 66579e6f04abfd293590d934 Finding the first thread to pull to get an investigation started can sometimes be difficult. Having a checklist and a structured approach to your investigation can help quite a bit. Experience also ca Tue, 08 Dec 2015 00:00:00 GMT Ryan Benson Visualizations Digital Forensics https://hindsig.ht/blog/upgrading-pythons-sqlite/ 66579e6f04abfd293590d936 SQLite and Python in DFIR SQLite databases are being used in more and more applications, and thus forensic examiners are increasingly running across them in investigations.  Python seems to be one of Sun, 22 Nov 2015 00:00:00 GMT Ryan Benson Open Source Tools Python Sqlite https://hindsig.ht/blog/hindsight-v1-5-released-gui/ 66579e6f04abfd293590d937 I am very excited to announce that Hindsight v1.5.0 is here! Graphical User Interface The core Hindsight functionality continues to see incremental improvements, along with quite a few internal cha Mon, 16 Nov 2015 00:00:00 GMT Ryan Benson Open Source Tools Web Browsers Digital Forensics https://hindsig.ht/blog/ryan-benson-featured-on-autopsy-blog/ 66579e6f04abfd293590d94b I will be speaking at the Open Source Digital Forensics Conference (OSDFCon) next month about a new tool I'm releasing. It's called SQUID, or SQLite Unknown Identifier, and it finds exact and near mat Thu, 10 Sep 2015 00:00:00 GMT Ryan Benson Presentations and Interviews Open Source Tools Sqlite Digital Forensics https://hindsig.ht/blog/visualizing-usn-journal-activity/ 66579e6f04abfd293590d938 Since learning about the USN journal, my investigative process has never been the same. It is a powerful artifact that can tell us much about what has transpired on a system. However, the wealth of da Wed, 27 May 2015 00:00:00 GMT Ryan Benson Visualizations Digital Forensics Open Source Tools https://hindsig.ht/blog/the-chrome-history-was-cleared-now-what-part-1/ 66579e6f04abfd293590d939 Settings and Bookmarks Ok, so for the sake of this post, let's assume that the answer to the question posed in the previous part ("Was the history cleared?") was yes, it was.  That totally wipes out Tue, 12 May 2015 00:00:00 GMT Ryan Benson Web Browsers Chrome Digital Forensics https://hindsig.ht/blog/the-chrome-history-was-cleared-now-what-part-0/ 66579e6f04abfd293590d93a First, let's take a step back.  Why do you think that the Chrome history had been cleared?  Is it because there are no browsing records at all?  Gaps in the entries?  Records that stop abruptly after Sat, 02 May 2015 00:00:00 GMT Ryan Benson Web Browsers Chrome Digital Forensics https://hindsig.ht/blog/its-all-about-time-hindsight-v1-4-released/ 66579e6f04abfd293590d93b Hindsight v1.4.0 is here and it has a number of improvements, all involving time.  As usual, you can get the update from Github or grab the zip directly. New(ish) Plugin: Time Discrepancy Finder - Ba Mon, 15 Dec 2014 00:00:00 GMT Ryan Benson Open Source Tools Web Browsers Hindsight Chrome https://hindsig.ht/blog/chrome-transition-values/ 66579e6f04abfd293590d93c The Chrome transition values are nothing new and haven't changed much through all the different releases of Chrome.  They have been discussed in a number of places.  However, most of the articles I've Fri, 19 Sep 2014 00:00:00 GMT Ryan Benson Web Browsers Digital Forensics Chrome https://hindsig.ht/blog/hindsight-v1-2-0-adds-chrome-cookie-decryption-and-logging/ 66579e6f04abfd293590d93d Hindsight v1.2.0 is out! This update adds two bigger new features and many small ones/fixes. The two big additions are decrypting some cookies and logging. Cookie Decryption As of v33, Chrome encry Mon, 08 Sep 2014 00:00:00 GMT Ryan Benson Open Source Tools Web Browsers Hindsight Cookies Python Chrome https://hindsig.ht/blog/archived-history-files-removed-from-chrome-v37/ 66579e6f04abfd293590d93e Chrome v37 was released last week and the new version has many stability fixes and improvements, as well as 50 security fixes.  It also brings the end of the 'Archived History' database, meaning Chrom Thu, 04 Sep 2014 00:00:00 GMT Ryan Benson Web Browsers Chrome https://hindsig.ht/blog/hindsight-v1-1-adds-sqlite-and-json-outputs/ 66579e6f04abfd293590d940 Hindsight v1.1.0 is live!  This first update since Hindsight migrated to Python about six weeks ago brings a number of improvements, but the biggest news is that Hindsight can now output to JSON and S Wed, 02 Jul 2014 00:00:00 GMT Ryan Benson Open Source Tools Hindsight https://hindsig.ht/blog/chrome-databases-reference-chart-updated-to-chrome-v35/ 66579e6f04abfd293590d941 Chrome updated to version 35 a few days ago, and I'm releasing an updated version of my "Evolution of Chrome Databases Reference Chart" to cover those new versions. The first version of the reference Tue, 27 May 2014 00:00:00 GMT Ryan Benson Visualizations Web Browsers Chrome Cookies https://hindsig.ht/blog/python-version-of-hindsight-released/ 66579e6f04abfd293590d942 Today I am releasing a Python version of Hindsight (a Google Chrome forensics tool).  The original version was in Perl and I learned quite a bit about both Chrome and Perl while developing it.  I want Fri, 23 May 2014 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Python https://hindsig.ht/blog/evolution-of-chrome-databases-reference-chart/ 66579e6f04abfd293590d943 Google's Chrome browser was updated to version 31 today. Chrome's rapid release cycle is great for quickly rolling out security fixes and new features, but it can also be a bit of a pain for amateur t Tue, 12 Nov 2013 00:00:00 GMT Ryan Benson Visualizations Web Browsers Chrome Cookies https://hindsig.ht/blog/hindsight-v0-84-released/ 66579e6f04abfd293590d944 An update to Hindsight is now available!  The new version (0.84) has some bug fixes and increased functionality (specifically regarding download records). Chrome made some significant changes to the w Mon, 14 Oct 2013 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Chrome Web Browsers https://hindsig.ht/blog/history-index-files-removed-from-chrome-v30/ 66579e6f04abfd293590d945 The new update of Chrome (v30) released yesterday has a number of security fixes, new features, and improvements, but it also unfortunately came with some bad news for forensicators: the History Index Wed, 02 Oct 2013 00:00:00 GMT Ryan Benson Web Browsers Chrome Sqlite https://hindsig.ht/blog/detecting-clock-changes-using-cookies/ 66579e6f04abfd293590d946 The forensics community has found many ways to identify system clock changes; Lee Whitfield's article and SANS presentation are excellent resources on the topic. In his presentation and in another pos Tue, 03 Sep 2013 00:00:00 GMT Ryan Benson Web Browsers Chrome Cookies Digital Forensics Hindsight Open Source Tools https://hindsig.ht/blog/hindsight-v0-83-fixes-issues-with-newest-chrome-versions-v26/ 66579e6f04abfd293590d947 A new version (0.83) of Hindsight is now available.  Chrome changed how it saves download records as of version 26; the download url is now in a separate table (downloads_url_chains) and a few new col Wed, 10 Jul 2013 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Chrome Web Browsers https://hindsig.ht/blog/hindsight-parses-chrome-preferences-file/ 66579e6f04abfd293590d948 After reading Jesse Kornblum's post Privacy Issues in Google Chrome are Opportunities for Forensic Examiners, I decided to see if I could incorporate some of the valuable information in the Chrome Pre Thu, 25 Oct 2012 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Web Browsers Chrome https://hindsig.ht/blog/announcing-hindsight-free-chrome-forensics-tool/ 66579e6f04abfd293590d949 Hindsight is a free tool for extracting, interpreting, and reporting on Google Chrome artifacts. Hindsight can extract useful data from a number of Chrome artifacts, including URLs, archived URLs, th Tue, 03 Jul 2012 00:00:00 GMT Ryan Benson Open Source Tools Hindsight Web Browsers Chrome https://hindsig.ht/blog/deleted-file-recovery-using-foremost/ 66579e6f04abfd293590d94a In this post, we'll use the Linux program foremost to recover files, both existing and deleted, from a .dd image. foremost is what is as known as a data-carving utility. It operates by examining data, Sat, 06 Aug 2011 00:00:00 GMT Ryan Benson Digital Forensics Open Source Tools https://hindsig.ht/blog/slack-space-introduction/ 66579e6f04abfd293590d950 Slack space can exist when a file's size is not a multiple of the file system's cluster size. As a little refresher, a sector is the smallest amount of data that a hard drive can read or write at one; Tue, 26 Jul 2011 00:00:00 GMT Ryan Benson Digital Forensics https://hindsig.ht/blog/imaging-using-dcfldd/ 66579e6f04abfd293590d951 In this post, a 128MB USB thumb drive will be imaged on a Linux system using dcfldd onto a 1GB USB thumb drive. dcfldd is an improved version of dd; most of the syntax is identical, just a few functio Sat, 02 Jul 2011 00:00:00 GMT Ryan Benson Digital Forensics Open Source Tools