Hindsight – Web browser Forensics for Google Chrome

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!).

Hindsight - Internet History Forensics for Google Chrome/Chromium
Hindsight – Internet History Forensics for Google Chrome/Chromium

Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies).

Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.

Some of the command line options are:

  • -i or –input         Path to the Chrome(ium) “Default” directory
  • -o or –output     Name of the output file (without extension)
  • -f or –format     Output format (default is XLSX, other options are SQLite and JSONL)
  • -c or –cache       Path to the cache directory; only needed if the directory is outside the given “input” directory. Mac systems are setup this way by default.
  • -b or –browser_type       The type of browser the input files belong to. Supported options are Chrome (default) and Brave.
  • -l or –log             Location Hindsight should log to (will append if exists)
  • -h or –help         Shows these options and the default Chrome data locations
  • -t or –timezone Display timezone for the timestamps in XLSX output

You can read more and download this tool over here: https://github.com/obsidianforensics/hindsight

Notify of
Inline Feedbacks
View all comments