v2026.06

Read more on the new features at https://dfir.blog/hindsight-parses-firefox/

Huge thanks to Steven R. Schiavone of the Westchester County District Attorney's Office for contributing Firefox support to Hindsight!

What's Changed

🚀 Features

• Add Mozilla Firefox support by @BitEU in #272
• Add parsing of Service Worker-related data by @RyanDFIR in #271
• Enhance extension handling: merge data from disk and Secure Preferenc… by @RyanDFIR in #273
• Expand downloads parsing by @RyanDFIR in #274
• Add support for parsing and summarizing Chrome Declarative Net Reques… by @RyanDFIR in #283

🛠️ Minor Changes & Fixes

• Implement browser auto-detection and improve profile processing logic… by @RyanDFIR in #275
• Refactor browser processing logic to use unified ProcessingDisplay … by @RyanDFIR in #276
• Add support for detecting and processing browser variants (Edge, Brav… by @RyanDFIR in #278
• Fix a few loose regexes by @RyanDFIR in #281
• Make source paths relative to profile when possible in XLSX rendering… by @RyanDFIR in #282
• Improve path normalization and key splitting logic in Chrome artifact… by @RyanDFIR in #284
• Update release process by @RyanDFIR in #285
• Add detailed permissions/scripts for extensions and add download headers by @RyanDFIR in #289

Other Changes

• Bump postcss from 8.5.3 to 8.5.13 by @dependabot[bot] in #269
• Add CodeQL workflow and custom configuration to exclude false-positiv… by @RyanDFIR in #279
• Update CodeQL workflow to include custom config for excluding false-p… by @RyanDFIR in #280
• Bump esbuild and vite by @dependabot[bot] in #277
• Bump version to 2026.06 by @RyanDFIR in #286
• Assorted small fixes by @RyanDFIR in #287
• Pin macOS build runners and update GitHub Actions dependencies by @RyanDFIR in #288

New Contributors

• @BitEU made their first contribution in #272

Full Changelog: v2026.04...v2026.06

v2026.04

Read more on the new features at https://dfir.blog/hindsight-parses-sessions-and-notifications/

What's Changed

🚀 Features

• Add support for Knowledge Graph entity resolution and categories by @RyanDFIR in #255
• Add parsing of platform notifications (using ccl_chromium_reader). Ad… by @RyanDFIR in #259
• Add Chrome session analysis, session reconstruction, and XLSX enhancements by @RyanDFIR in #264

🛠️ Minor Changes & Fixes

• Fix a bug in OPFS processing logic that would only show either t or… by @RyanDFIR in #246
• Add parsing of additional Chrome cookie fields (top_frame_site_key … by @RyanDFIR in #247
• Add support for parsing opener_visit field in Chrome history data a… by @RyanDFIR in #248
• Add (experimental) support for new cache types (DawnCache, DawnWebGPUCache, DawnGraphiteCache) by @RyanDFIR in #251
• Update some row types and XLSX coloring to better reflect their function by @RyanDFIR in #253
• Enhance Chrome IndexedDB processing for Blobs by @RyanDFIR in #258
• Refactor SQLite query execution to use a reusable context manager, im… by @RyanDFIR in #265
• Add an explicit "Source Item" column showing where the row was sourced from. by @RyanDFIR in #267
• Small formatting updates to XLSX output (Sessions tab and page headers) by @RyanDFIR in #268

Other Changes

• Add Unicode support check for banner and fallback for non-Unicode con… by @RyanDFIR in #252
• Up max version to 145; slight color tweaking. by @RyanDFIR in #254
• Potential fix for code scanning alert no. 1: Workflow does not contain permissions by @RyanDFIR in #256
• Bump rollup from 4.35.0 to 4.59.0 by @dependabot[bot] in #257
• Bump vite from 6.4.1 to 6.4.2 by @dependabot[bot] in #262
• Bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in #261
• Replace pytz with zoneinfo for timezone handling and update depen… by @RyanDFIR in #266

Full Changelog: v2026.01...v2026.04

v2026.01

What's Changed

🚀 Features

• Add parsing of Sync Data by @obsidianforensics in #234
• Add support for originator GUIDs and simplify Sync Data labels by @obsidianforensics in #237
• Add parsing of permission_actions from Preferences file, and misc s… by @obsidianforensics in #227
• Introduce rich library for improved UI/UX and refactor artifact pro… by @obsidianforensics in #241

🛠️ Minor Changes & Fixes

• Fix outdated plugin blog post links by @juliapaluch in #218
• Fix crash when encountering unexpected extension version strings. by @obsidianforensics in #226
• Add updated parsing for changes to DIPS in v142. by @obsidianforensics in #229
• Make creating the logical paths for the File System more tolerant of … by @obsidianforensics in #231
• Add translation of accountcapabilities to human-readable from Preferences. by @obsidianforensics in #232
• Improve JSONL output. Added parsing for Chrome IndexedDB, Extension Storage, Sync Data, and Installed Extensions record types. by @obsidianforensics in #238
• Prevent errors by adding directory existence checks and improve file … by @obsidianforensics in #242
• Add some new danger_type and interrupt_reason codes, and reformat for… by @obsidianforensics in #224
• Add generic parsing for simple preference timestamp values. by @obsidianforensics in #228
• Address ResourceWarnings by adding more robust file-closing and suppre… by @obsidianforensics in #235
• Remove the Brave option for now; (old) parsing code remains. More wor… by @obsidianforensics in #236
• Improve SQLite output, making it comparable to the XLSX and JSONL out… by @obsidianforensics in #239
• Add support for "Login Data For Account" database parsing in Chrome a… by @obsidianforensics in #243

New Contributors

• @juliapaluch made their first contribution in #218

Full Changelog: v2025.03...v2026.01

v2025.03

What's Changed

🚀 Features

• Add parsing of multiple databases related to Extensions by @obsidianforensics in #205
  • Added a new output tab/table called Extension Data to display it

🛠️ Minor Changes & Fixes

• Add Extension permissions and manifest to output. Refactor Extension parsing to be more concise by @obsidianforensics in #208
• Add try/except around Cache parsing to keep Hindsight from completely… by @obsidianforensics in #203

Other Changes

• Update setup.py for new PyPI release by @obsidianforensics in #195
• Regexp fix Update hindsight_gui.py by @demireng in #197
• Update SQLite output to have Extension Data by @obsidianforensics in #210
• 2025.03 release by @obsidianforensics in #211

New Contributors

• @demireng made their first contribution in #197

Full Changelog: v2024.10...v2025.03

v2024.10

What's Changed

🚀 Features

• Add parsing of DIPS (Detect Incidental Party State) database by @obsidianforensics in #146
• Add parsing of IndexedDB records. Update included ccl_chrome_indexedd… by @obsidianforensics in #173
• Switch cache parsing code to use ccl_chromium_reader by @obsidianforensics in #182

🛠️ Minor Changes & Fixes

• Add executing a test query when opening databases to catch corrupt da… by @obsidianforensics in #153
• Upgrade protobuf>=4.23 in requirements.txt and regenerate site_data_p… by @obsidianforensics in #154
• In a URLItem, replace the url_id property with visit_id. Update outpu… by @obsidianforensics in #157
• Add try/except around urllib parsing. Modify the HSTS domain parsing … by @obsidianforensics in #163
• Update determine_version() to account for recent Chrome versions (up … by @obsidianforensics in #166
• Catch exception on edge case where downloads table is not present by @obsidianforensics in #167
• Add more exception handling to address issues raised in #169 by @obsidianforensics in #170
• Update DIPS parsing with new columns and popups table by @obsidianforensics in #171
• Fix sorting error when an item is missing tzinfo (and add warning) by @obsidianforensics in #172
• Fix TypeError by @ryneeverett in #174
• sqlite-view: 0.1.8 -> 0.2.0 by @ryneeverett in #175
• Correct inconsistent use of quotation marks in metadata attribute access in webbrowser.py by @notwhickey in #183
• Swap bundled ccl_chromium_indexeddb for newer version pulled from GitHub by @obsidianforensics in #184
• Clean up utils.py (replace deprecated utcfromtimestamp function, fi… by @obsidianforensics in #185
• Switch to ccl_chromium_reader from bundled ccl_* code for session sto… by @obsidianforensics in #186
• Up the max Chrome version to 129. Add get_clean_hostnames function … by @obsidianforensics in #187
• Switch to using origin_url column instead of action_url. Update t… by @obsidianforensics in #190
• Updates for v2024.10 by @obsidianforensics in #191

Other Changes

• Update social logos and contact info by @obsidianforensics in #164
• Adding Windows 11 default path and generic way to find profile under inputs_selector by @Jlcasado in #179

New Contributors

• @Jlcasado made their first contribution in #179
• @notwhickey made their first contribution in #183

Full Changelog: v2023.03...v2024.10

v2023.03

This is the first release in a while and it's a relatively minor one. It's mainly bug fixes and updating the version detection for Chrome versions that have come out since the last release. I hope to have time to work on a more substantial update in the future, but for now, here's v2023.03!

What's Changed

🛠️ Minor Changes & Fixes

• Add Session Storage records to SQLite output by @obsidianforensics in #119
• Update built list of HSTS host hashes to include domains from cookies by @obsidianforensics in #121
• Fix some packaging issues (line endings, including lib files, other small fixes) by @obsidianforensics in #122
• Fix bug where when a version rollback occurs more than once, it doesn… by @obsidianforensics in #138
• Fixes issue 125, where failing to decode an extension manifest caused… by @obsidianforensics in #139

Other Changes

• Account for relocated files in newer Chrome versions (97-100) by @obsidianforensics in #124
• Update README.md by @obsidianforensics in #132
• Update version detection to include Chrome 101-111 by @obsidianforensics in #140
• Update Hindsight version prior to release and remove Unfurl plugin (u… by @obsidianforensics in #142

Full Changelog: v2021.12...v2023.03

Both the GUI and command line versions of this release are available as:

• compiled exes attached to this release or in the dist/ folder
• .py versions are available by pip install pyhindsight or by downloading/cloning the GitHub repo.

v2021.12

What's Changed

🚀 Features

• Support for Chrome 91-96 by @obsidianforensics in #107, #117
• Add parsing of TransportSecurity file (HSTS settings).
• Add parsing of Session Storage #102
• Adds new "Site Setting" record type, which includes settings and preferences that are site-specific, including zoom, mute, hsts, engagement, and potentially more. #100
• More parsing of Preference items: network_prediction_options, password_manager, sessions.event_log, and sync settings. #101

🛠️ Minor Changes & Fixes

• Fix for case with missing Brave version by @cteodor in #99
• Update embedded ccl_chromium_indexeddb by @obsidianforensics in #102
• Timestamp sorting bug caused by incorrectly interpreting microsecond timestamps by @obsidianforensics in #103
• When searching for Profiles, don't follow symlinks (reports of loops,… by @obsidianforensics in #104
• Add try/except around reading Session Storage records in case of Leve… by @obsidianforensics in #106
• Two small quality of life improvements by @kumavis in #111
• chmod +x hindsight_gui.py by @kumavis in #112
• Report analysis session error by @kumavis in #113
• Add support for new Network subdirectory and files moved within it by @obsidianforensics in #116

Full Changelog: v2021.04.26...v2021.12

New Contributors

• @cteodor made their first contribution in #99
• @kumavis made their first contribution in #111

Both the GUI and command line versions of this release are available as:

• compiled exes attached to this release or in the dist/ folder
• .py versions are available by pip install pyhindsight or by downloading/cloning the GitHub repo.

Hindsight 2021.04.26

The 2021.04.26 release of Hindsight is here! Check out the blog post or read on for details on the changes:

🚀 Features

• Parse "Site Characteristics Database" LevelDB @obsidianforensics (#73)
• Add plugin to run Unfurl across Local Storage values @obsidianforensics (#77)
• Add support for Chrome 88 - 90 (#72, #79)

🛠️ Minor Changes & Fixes

• Update Chrome Extensions parser to work on updated artifact types. @obsidianforensics (#82)
• Added additional download interrupt_reason codes. Minor style fixes. @obsidianforensics (#81)
• Add more exception handling around LevelDB records in case of corruption @obsidianforensics (#78)
• Add check to ensure duration values in Media History are plausible @obsidianforensics (#75)
• Fix bug in per_host_zoom_levels parsing @obsidianforensics (#74)
• If autofill values are encrypted (as Edge's are), replace the encrypted bytes with a placeholder @obsidianforensics (#70)
• Add new visit_source values to Update chrome.py @chadtilbury (#68)

Both the GUI and command line versions of this release are available as:

• compiled exes attached to this release or in the dist/ folder
• .py versions are available by pip install pyhindsight or by downloading/cloning the GitHub repo.

Hindsight 2021.01.16

The 2021.01.16 release of Hindsight adds some new features, including improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more! Blog post with more info.

Details:

• Switch to using CCL Forensics' LevelDB parsing code; makes parsing use less dependencies & allows recovery of some deleted records
• Add ability to view results of parsing in the Hindsight web UI, using a SQL-like interface
• Add parsing of new Media History database
• Add support for Chrome 84 - 87
• Parse additional login items using the stats table
• Improve Bookmarks parsing to include synced bookmarks
• Add flag (enabled by default) for copying SQLite databases to a temp directory before opening them
• Change default logging & output directories to be the current working directory

Both the GUI and command line versions of this release are available as:

• compiled exes attached to this release or in the dist/ folder
• .py versions are available by pip install pyhindsight or by downloading/cloning the GitHub repo.

EDIT: Windows Defender has been flagging the EXEs as malware, presumably because they were packaged with PyInstaller. The Python script versions are not being flagged. If you'd like to build the EXEs from the Python code yourself, all I did was: pyinstaller --distpath .\dist .\spec\hindsight.spec from the root of the repo.

Hindsight v20200607

Hindsight v20200607 is the first Python 3 release. This involved lots of code refactoring and clean-up. Things should generally run better and faster. It also includes support for the newest versions of Chrome and other small fixes.

Both the GUI and command line versions of this release are available as:

• compiled exes attached to this release or in the dist/ folder
• .py versions are available by pip install pyhindsight or downloading/cloning the GitHub repo.