Hindsight – Internet History Forensics for Google Chrome/Chromium

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!).

It has a simple web UI – to start it, run “hindsight_gui.py” (or on Windows, the packaged “hindsight_gui.exe”) and visit http://localhost:8080 in a browser:

Hindsight - Internet History Forensics for Google Chrome/Chromium
Hindsight – Internet History Forensics for Google Chrome/Chromium

Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.

The only field you are required to complete is “Profile Path”. This is the location of the Chrome profile you want to analyze (the default profile paths for different OSes is listed at the bottom of this page). Click “Run” and you’ll be taken to the results page in where you can save the results to a spreadsheet (or other formats).

Hindsight latest version 2.4.0 added JSONL output, support for the newest versions of Chrome, and other small fixes.

  • Supports Chrome versions 1 – 76
  • Adds JSONL output format, which is compatible with Timesketch. The field names in this output type are aligned with Plaso/Timesketch (other output formats remain unchanged).
  • Parses other Chrome files, even if History file is absent (as in the case of Time Machine backups)

Both the GUI and command line versions of this release are available as:

  • compiled exes attached to this release or in the dist/ folder
  • .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.

You can read more and download the latest release over here: https://github.com/obsidianforensics/hindsight

Notify of
Inline Feedbacks
View all comments