corpus.blog
41554 blogs · [ { "id": "01a0c507-d4d3-72bc-8e48-1320ea8462ce", "title": "Introducing Hindsight Foundry", "url": "https://hindsig.ht/blog/introducing-hindsight-foundry/", "published_at": "2026-09-18T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38b970219", "title": "Hindsight adds Firefox support!", "url": "https://dfir.blog/hindsight-parses-firefox/", "published_at": "2026-07-08T23:41:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320eb26c6c5", "title": "Hindsight adds Firefox support!", "url": "https://hindsig.ht/blog/hindsight-parses-firefox/", "published_at": "2026-07-08T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38bdc3276", "title": "Hindsight v2026.04 Released!", "url": "https://dfir.blog/hindsight-parses-sessions-and-notifications/", "published_at": "2026-05-02T20:09:50+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320eb8384a2", "title": "Hindsight v2026.04 Released!", "url": "https://hindsig.ht/blog/hindsight-parses-sessions-and-notifications/", "published_at": "2026-05-02T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38c357ea4", "title": "Hindsight v2026.01 Released!", "url": "https://dfir.blog/hindsight-v2026-01/", "published_at": "2026-02-04T18:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ebb027ff", "title": "Hindsight v2026.01 Released!", "url": "https://hindsig.ht/blog/hindsight-v2026-01/", "published_at": "2026-02-04T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38c508509", "title": "Unfurl 2025.03", "url": "https://dfir.blog/unfurl-parses-googe-udm-and-truth-social/", "published_at": "2025-03-13T13:30:40+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ec8d9070", "title": "Unfurl 2025.03", "url": "https://hindsig.ht/blog/unfurl-parses-googe-udm-and-truth-social/", "published_at": "2025-03-13T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38d369131", "title": "Hindsight v2025.03 Released!", "url": "https://dfir.blog/hindsight-parses-browser-extensions/", "published_at": "2025-03-11T17:02:06+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ed4010cc", "title": "Hindsight v2025.03 Released!", "url": "https://hindsig.ht/blog/hindsight-parses-browser-extensions/", "published_at": "2025-03-11T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38ded57c3", "title": "Unfurl v2025.02 Released", "url": "https://dfir.blog/unfurl-parses-obfuscated-ip-addresses/", "published_at": "2025-02-19T14:41:19+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ed588fbe", "title": "Unfurl v2025.02 Released", "url": "https://hindsig.ht/blog/unfurl-parses-obfuscated-ip-addresses/", "published_at": "2025-02-19T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38e2e22fd", "title": "Authenticating Screenshots from Netflix's Carry-On Movie", "url": "https://dfir.blog/authenticating-screenshots-from-netflix-carry-on-movie/", "published_at": "2025-01-13T17:12:09+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ed600320", "title": "Authenticating Screenshots from Netflix's Carry-On Movie", "url": "https://hindsig.ht/blog/authenticating-screenshots-from-netflix-carry-on-movie/", "published_at": "2025-01-13T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38f005498", "title": "Video of \"What Can DFIQ Do For You?\" Posted", "url": "https://dfir.blog/dfiq-video-at-sans-dfir-summit-2023/", "published_at": "2023-12-20T17:59:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320edb665dc", "title": "Video of \"What Can DFIQ Do For You?\" Posted", "url": "https://hindsig.ht/blog/dfiq-video-at-sans-dfir-summit-2023/", "published_at": "2023-12-20T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38f4835b0", "title": "Unfurl v2023.09 Released!", "url": "https://dfir.blog/unfurl-parsing-jwt-and-doh/", "published_at": "2023-09-27T13:30:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ee4234a1", "title": "Unfurl v2023.09 Released!", "url": "https://hindsig.ht/blog/unfurl-parsing-jwt-and-doh/", "published_at": "2023-09-27T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b38fa0902a", "title": "Unfurl v2022.11: Social Media Edition", "url": "https://dfir.blog/unfurl-parsing-twitter-mastodon-linkedin/", "published_at": "2022-11-10T14:18:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ef304465", "title": "Unfurl v2022.11: Social Media Edition", "url": "https://hindsig.ht/blog/unfurl-parsing-twitter-mastodon-linkedin/", "published_at": "2022-11-10T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b3909f69df", "title": "More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02", "url": "https://dfir.blog/search-parsing-and-misp-lists-in-unfurl/", "published_at": "2022-03-02T14:41:01+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f00c5fe0", "title": "More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02", "url": "https://hindsig.ht/blog/search-parsing-and-misp-lists-in-unfurl/", "published_at": "2022-03-02T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b391855c79", "title": "Hindsight v2021.12", "url": "https://dfir.blog/hindsight-v2021-12/", "published_at": "2021-12-21T14:14:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f08f6653", "title": "Hindsight v2021.12", "url": "https://hindsig.ht/blog/hindsight-v2021-12/", "published_at": "2021-12-21T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b391aaf985", "title": "Cookies Database Moving in Chrome 96", "url": "https://dfir.blog/cookies-database-moving-in-chrome-96/", "published_at": "2021-12-16T15:28:34+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f098feae", "title": "Cookies Database Moving in Chrome 96", "url": "https://hindsig.ht/blog/cookies-database-moving-in-chrome-96/", "published_at": "2021-12-16T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b3923a7005", "title": "Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15", "url": "https://dfir.blog/metasploit-urls-and-hash-lookups-in-unfurl/", "published_at": "2021-06-15T13:19:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f0a8ed1b", "title": "Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15", "url": "https://hindsig.ht/blog/metasploit-urls-and-hash-lookups-in-unfurl/", "published_at": "2021-06-15T00:00:00+00:00" }, { "id": "01a0876c-4c3f-73c8-8a16-47b392a0986b", "title": "Unfurl Plugin and \"Site Characteristics\" Artifact Added in Hindsight", "url": "https://dfir.blog/unfurl-plugin-and-site-characteristics-database-added-to-hindsight/", "published_at": "2021-04-28T17:34:59+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f1779874", "title": "Unfurl Plugin and \"Site Characteristics\" Artifact Added in Hindsight", "url": "https://hindsig.ht/blog/unfurl-plugin-and-site-characteristics-database-added-to-hindsight/", "published_at": "2021-04-28T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f1d7c184", "title": "Keystroke Flow from Chrome Omnibox", "url": "https://hindsig.ht/blog/keystroke-flow-from-chrome-omnibox/", "published_at": "2021-02-18T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f26b08ea", "title": "New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!", "url": "https://hindsig.ht/blog/hindsight-better-leveldb-and-new-web-ui/", "published_at": "2021-01-18T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f2a33659", "title": "A Year of #DailyDFIR", "url": "https://hindsig.ht/blog/a-year-of-dailydfir/", "published_at": "2020-12-31T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f3426d6f", "title": "\"Cache Up\" with Ryan Benson", "url": "https://hindsig.ht/blog/cache-up-with-ryan-benson/", "published_at": "2020-10-28T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f3a599fc", "title": "New \"Media History\" File Added to Chrome", "url": "https://hindsig.ht/blog/media-history-database-added-to-chrome/", "published_at": "2020-10-13T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f442c971", "title": "Unfurl on \"Life Has No Ctrl+Alt+Delete\"", "url": "https://hindsig.ht/blog/unfurl-on-ctrl-alt-delete/", "published_at": "2020-09-28T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f45b4fee", "title": "Video of \"Extract & Visualize Data from URLs using Unfurl\" Posted", "url": "https://hindsig.ht/blog/unfurl-video-at-sans-dfir-summit-2020/", "published_at": "2020-09-20T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f53d4aaf", "title": "Tinkering with TikTok Timestamps", "url": "https://hindsig.ht/blog/tinkering-with-tiktok-timestamps/", "published_at": "2020-08-11T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f5b29dc8", "title": "New Unfurl Version Released", "url": "https://hindsig.ht/blog/new-unfurl-adds-rlz-shortlink-mailto-parsing/", "published_at": "2020-08-05T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f5ed2bec", "title": "Another Google Search Parameter? For RLZ!", "url": "https://hindsig.ht/blog/google-search-rlz/", "published_at": "2020-07-30T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f62a4cf2", "title": "Unfurl CLI version (and now on PyPI)", "url": "https://hindsig.ht/blog/unfurl-cli-version-now-on-pypi/", "published_at": "2020-06-30T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f6607295", "title": "Hindsight is 2020", "url": "https://hindsig.ht/blog/hindsight-is-2020/", "published_at": "2020-06-10T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f74485b2", "title": "Unfurling Unknown Protobufs", "url": "https://hindsig.ht/blog/unfurling-unknown-protobufs/", "published_at": "2020-04-08T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f82f63a8", "title": "Unfurl... in 3D", "url": "https://hindsig.ht/blog/unfurl-in-3d/", "published_at": "2020-04-01T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f8ea0732", "title": "Google \"ved\" Parameter Versions", "url": "https://hindsig.ht/blog/google-ved-versions/", "published_at": "2020-02-27T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f98aa533", "title": "Talking about Unfurl on the Forensic Lunch", "url": "https://hindsig.ht/blog/talking-about-unfurl-on-the-forensic-lunch/", "published_at": "2020-01-24T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f990c5b6", "title": "Introducing Unfurl", "url": "https://hindsig.ht/blog/introducing-unfurl/", "published_at": "2019-12-12T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f9ab81e9", "title": "Deciphering Browser Hieroglyphics: FileSystem (Part 3)", "url": "https://hindsig.ht/blog/deciphering-browser-hieroglyphics-leveldb-filesystem/", "published_at": "2019-08-08T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320f9eba9ea", "title": "Deciphering Browser Hieroglyphics: LocalStorage (Part 2)", "url": "https://hindsig.ht/blog/deciphering-browser-hieroglyphics-localstorage/", "published_at": "2019-08-02T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fa2f083b", "title": "Hindsight v2.4 Adds JSONL Output", "url": "https://hindsig.ht/blog/hindsight-v2-4-adds-jsonl-output/", "published_at": "2019-08-01T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320faa26777", "title": "Deciphering Browser Hieroglyphics: Intro (Part 1)", "url": "https://hindsig.ht/blog/deciphering-browser-hieroglyphics-intro/", "published_at": "2019-07-22T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320faf5118a", "title": "Solving Magnet Forensics CTF with Plaso, Timesketch, and Colab", "url": "https://hindsig.ht/blog/solving-magnet-forensics-ctf-with-plaso-timesketch-colab/", "published_at": "2019-04-23T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fbad4adc", "title": "A First Look at Chromium-Based Edge", "url": "https://hindsig.ht/blog/a-first-look-at-chromium-based-edge/", "published_at": "2019-04-09T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fbb0d859", "title": "Hindsight v2.3 Finds and Parses Multiple Chrome Profiles", "url": "https://hindsig.ht/blog/hindsight-v2-3-find-parse-multiple-chrome-profiles/", "published_at": "2019-03-15T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fc61a967", "title": "Chrome Values Lookup Tables", "url": "https://hindsig.ht/blog/chrome-values-lookup-tables/", "published_at": "2019-02-28T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fcb3a2f8", "title": "Capturing Chrome's Evolution", "url": "https://hindsig.ht/blog/capturing-chromes-evolution/", "published_at": "2019-02-20T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fd3b0c73", "title": "New Year, New dfir.blog", "url": "https://hindsig.ht/blog/new-year-new-dfir-blog/", "published_at": "2019-01-14T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fde2e6e9", "title": "Hindsight", "url": "https://hindsig.ht/blog/hindsight/", "published_at": "2019-01-01T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fe3ef3f0", "title": "Video of \"Efficiently Summarizing Web Browsing Activity\" at SANS DFIR Summit 2018", "url": "https://hindsig.ht/blog/efficiently-summarizing-web-browsing-activity/", "published_at": "2018-12-07T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320fec02b08", "title": "Ryan Benson Interviewed by BBC Click about Web Browsers", "url": "https://hindsig.ht/blog/ryan-benson-bbc-click-interview-web-browsers/", "published_at": "2018-05-23T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ff0dc025", "title": "Hindsight v2.2 Parses More Chrome Preference Items", "url": "https://hindsig.ht/blog/hindsight-v2-2-more-chrome-preference-items/", "published_at": "2018-05-04T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1320ffc00acc", "title": "Deciphering Browser Hieroglyphics", "url": "https://hindsig.ht/blog/deciphering-browser-hieroglyphics/", "published_at": "2017-09-20T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132100bfd030", "title": "Visualizing Activity from Metadata", "url": "https://hindsig.ht/blog/visualizing-activity-from-metadata/", "published_at": "2017-06-29T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321014cb40a", "title": "Hindsight v2 Adds a Web UI and Cache Parsing", "url": "https://hindsig.ht/blog/hindsight-v2-adds-web-ui-and-cache-parsing/", "published_at": "2017-03-08T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132102078092", "title": "Investigating Universal Analytics", "url": "https://hindsig.ht/blog/investigating-universal-analytics/", "published_at": "2016-12-16T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132102cb2c1b", "title": "Load Balancer Cookie Decoder", "url": "https://hindsig.ht/blog/load-balancer-cookie-decoder/", "published_at": "2016-06-23T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132102fb1e3b", "title": "Alexa, Tell Me Your Secrets", "url": "https://hindsig.ht/blog/alexa-tell-me-your-secrets/", "published_at": "2016-06-06T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321038ff70d", "title": "It's a \"Brave\" New World... or is it?", "url": "https://hindsig.ht/blog/its-a-brave-new-world-or-is-it/", "published_at": "2016-03-18T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132104401cb6", "title": "Video of \"Customized Google Chrome Forensics with Python\" at SANS DFIR Summit 2015", "url": "https://hindsig.ht/blog/customized-google-chrome-forensics-with-python-sans-dfir-summit-2015/", "published_at": "2015-12-11T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132104d3043a", "title": "Finding the First Thread with a Visualization", "url": "https://hindsig.ht/blog/finding-the-first-thread-with-a-visualization/", "published_at": "2015-12-08T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321057ad4fb", "title": "Upgrading Python's SQLite", "url": "https://hindsig.ht/blog/upgrading-pythons-sqlite/", "published_at": "2015-11-22T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210678d5b4", "title": "Hindsight v1.5.0 released + GUI!", "url": "https://hindsig.ht/blog/hindsight-v1-5-released-gui/", "published_at": "2015-11-16T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132106f3b9f8", "title": "Featured on Autopsy Blog", "url": "https://hindsig.ht/blog/ryan-benson-featured-on-autopsy-blog/", "published_at": "2015-09-10T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132107f31347", "title": "Visualizing USN Journal Activity", "url": "https://hindsig.ht/blog/visualizing-usn-journal-activity/", "published_at": "2015-05-27T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132108546ceb", "title": "The Chrome history was cleared!  Now what? (part 1)", "url": "https://hindsig.ht/blog/the-chrome-history-was-cleared-now-what-part-1/", "published_at": "2015-05-12T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321092bb4c0", "title": "The Chrome history was cleared! Now what? (part 0)", "url": "https://hindsig.ht/blog/the-chrome-history-was-cleared-now-what-part-0/", "published_at": "2015-05-02T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132109f9c8d7", "title": "It's All About Time - Hindsight v1.4 Released", "url": "https://hindsig.ht/blog/its-all-about-time-hindsight-v1-4-released/", "published_at": "2014-12-15T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210ae584c1", "title": "Chrome Transition Values", "url": "https://hindsig.ht/blog/chrome-transition-values/", "published_at": "2014-09-19T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210b9b63b8", "title": "Hindsight v1.2.0 Adds Chrome Cookie Decryption and Logging", "url": "https://hindsig.ht/blog/hindsight-v1-2-0-adds-chrome-cookie-decryption-and-logging/", "published_at": "2014-09-08T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210b9eec1d", "title": "Archived History files removed from Chrome v37", "url": "https://hindsig.ht/blog/archived-history-files-removed-from-chrome-v37/", "published_at": "2014-09-04T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210c3a25dd", "title": "Hindsight v1.1.0 Adds SQLite and JSON Outputs", "url": "https://hindsig.ht/blog/hindsight-v1-1-adds-sqlite-and-json-outputs/", "published_at": "2014-07-02T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210c4eaafa", "title": "Chrome Databases Reference Chart Updated to Chrome v35", "url": "https://hindsig.ht/blog/chrome-databases-reference-chart-updated-to-chrome-v35/", "published_at": "2014-05-27T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210ca3be0a", "title": "Python version of Hindsight Released", "url": "https://hindsig.ht/blog/python-version-of-hindsight-released/", "published_at": "2014-05-23T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210d2f6efa", "title": "The Evolution of Chrome Databases Reference Chart", "url": "https://hindsig.ht/blog/evolution-of-chrome-databases-reference-chart/", "published_at": "2013-11-12T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210def8b88", "title": "Hindsight v0.84 Released", "url": "https://hindsig.ht/blog/hindsight-v0-84-released/", "published_at": "2013-10-14T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210e5db9d8", "title": "History Index files removed from Chrome v30", "url": "https://hindsig.ht/blog/history-index-files-removed-from-chrome-v30/", "published_at": "2013-10-02T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-13210f532338", "title": "Detecting Clock Changes Using Cookies", "url": "https://hindsig.ht/blog/detecting-clock-changes-using-cookies/", "published_at": "2013-09-03T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321104cb09e", "title": "Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)", "url": "https://hindsig.ht/blog/hindsight-v0-83-fixes-issues-with-newest-chrome-versions-v26/", "published_at": "2013-07-10T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132110b0bc18", "title": "Hindsight Adds Parsing of Chrome Preferences file", "url": "https://hindsig.ht/blog/hindsight-parses-chrome-preferences-file/", "published_at": "2012-10-25T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-132111920dda", "title": "Announcing Hindsight: A Free Chrome Forensics Tool", "url": "https://hindsig.ht/blog/announcing-hindsight-free-chrome-forensics-tool/", "published_at": "2012-07-03T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321124993c2", "title": "Deleted File Recovery using foremost", "url": "https://hindsig.ht/blog/deleted-file-recovery-using-foremost/", "published_at": "2011-08-06T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321126d4415", "title": "Slack Space", "url": "https://hindsig.ht/blog/slack-space-introduction/", "published_at": "2011-07-26T00:00:00+00:00" }, { "id": "01a0c507-d4d3-72bc-8e48-1321128e1ab9", "title": "Imaging Using dcfldd", "url": "https://hindsig.ht/blog/imaging-using-dcfldd/", "published_at": "2011-07-02T00:00:00+00:00" } ] posts Claim your blog
Back to dfir.blog
Blog · corpus.blog/blogs/dfir.blog/posts

dfir.blog

dfir.blog

2026

Introducing Hindsight Foundryoriginal ↗
18 Sept 2026
Hindsight adds Firefox support!original ↗
8 Jul 2026
Hindsight adds Firefox support!original ↗
8 Jul 2026
Hindsight v2026.04 Released!original ↗
2 May 2026
Hindsight v2026.04 Released!original ↗
2 May 2026
Hindsight v2026.01 Released!original ↗
4 Feb 2026
Hindsight v2026.01 Released!original ↗
4 Feb 2026

2025

Unfurl 2025.03original ↗
13 Mar 2025
Unfurl 2025.03original ↗
13 Mar 2025
Hindsight v2025.03 Released!original ↗
11 Mar 2025
Hindsight v2025.03 Released!original ↗
11 Mar 2025
Unfurl v2025.02 Releasedoriginal ↗
19 Feb 2025
Unfurl v2025.02 Releasedoriginal ↗
19 Feb 2025
Authenticating Screenshots from Netflix's Carry-On Movieoriginal ↗
13 Jan 2025
Authenticating Screenshots from Netflix's Carry-On Movieoriginal ↗
13 Jan 2025

2023

Video of "What Can DFIQ Do For You?" Postedoriginal ↗
20 Dec 2023
Video of "What Can DFIQ Do For You?" Postedoriginal ↗
20 Dec 2023
Unfurl v2023.09 Released!original ↗
27 Sept 2023
Unfurl v2023.09 Released!original ↗
27 Sept 2023

2022

Unfurl v2022.11: Social Media Editionoriginal ↗
10 Nov 2022
Unfurl v2022.11: Social Media Editionoriginal ↗
10 Nov 2022
More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02original ↗
2 Mar 2022
More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02original ↗
2 Mar 2022

2021

Hindsight v2021.12original ↗
21 Dec 2021
Hindsight v2021.12original ↗
21 Dec 2021
Cookies Database Moving in Chrome 96original ↗
16 Dec 2021
Cookies Database Moving in Chrome 96original ↗
16 Dec 2021
Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15original ↗
15 Jun 2021
Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15original ↗
15 Jun 2021
Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsightoriginal ↗
28 Apr 2021
Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsightoriginal ↗
28 Apr 2021
Keystroke Flow from Chrome Omniboxoriginal ↗
18 Feb 2021
New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!original ↗
18 Jan 2021

2020

A Year of #DailyDFIRoriginal ↗
31 Dec 2020
"Cache Up" with Ryan Bensonoriginal ↗
28 Oct 2020
New "Media History" File Added to Chromeoriginal ↗
13 Oct 2020
Unfurl on "Life Has No Ctrl+Alt+Delete"original ↗
28 Sept 2020
Video of "Extract & Visualize Data from URLs using Unfurl" Postedoriginal ↗
20 Sept 2020
Tinkering with TikTok Timestampsoriginal ↗
11 Aug 2020
New Unfurl Version Releasedoriginal ↗
5 Aug 2020
Another Google Search Parameter? For RLZ!original ↗
30 Jul 2020
Unfurl CLI version (and now on PyPI)original ↗
30 Jun 2020
Hindsight is 2020original ↗
10 Jun 2020
Unfurling Unknown Protobufsoriginal ↗
8 Apr 2020
Unfurl... in 3Doriginal ↗
1 Apr 2020
Google "ved" Parameter Versionsoriginal ↗
27 Feb 2020
Talking about Unfurl on the Forensic Lunchoriginal ↗
24 Jan 2020

2019

Introducing Unfurloriginal ↗
12 Dec 2019
Deciphering Browser Hieroglyphics: FileSystem (Part 3)original ↗
8 Aug 2019
Deciphering Browser Hieroglyphics: LocalStorage (Part 2)original ↗
2 Aug 2019
Hindsight v2.4 Adds JSONL Outputoriginal ↗
1 Aug 2019
Deciphering Browser Hieroglyphics: Intro (Part 1)original ↗
22 Jul 2019
Solving Magnet Forensics CTF with Plaso, Timesketch, and Colaboriginal ↗
23 Apr 2019
A First Look at Chromium-Based Edgeoriginal ↗
9 Apr 2019
Hindsight v2.3 Finds and Parses Multiple Chrome Profilesoriginal ↗
15 Mar 2019
Chrome Values Lookup Tablesoriginal ↗
28 Feb 2019
Capturing Chrome's Evolutionoriginal ↗
20 Feb 2019
New Year, New dfir.blogoriginal ↗
14 Jan 2019
Hindsightoriginal ↗
1 Jan 2019

2018

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018original ↗
7 Dec 2018
Ryan Benson Interviewed by BBC Click about Web Browsersoriginal ↗
23 May 2018
Hindsight v2.2 Parses More Chrome Preference Itemsoriginal ↗
4 May 2018

2017

Deciphering Browser Hieroglyphicsoriginal ↗
20 Sept 2017
Visualizing Activity from Metadataoriginal ↗
29 Jun 2017
Hindsight v2 Adds a Web UI and Cache Parsingoriginal ↗
8 Mar 2017

2016

Investigating Universal Analyticsoriginal ↗
16 Dec 2016
Load Balancer Cookie Decoderoriginal ↗
23 Jun 2016
Alexa, Tell Me Your Secretsoriginal ↗
6 Jun 2016
It's a "Brave" New World... or is it?original ↗
18 Mar 2016

2015

Video of "Customized Google Chrome Forensics with Python" at SANS DFIR Summit 2015original ↗
11 Dec 2015
Finding the First Thread with a Visualizationoriginal ↗
8 Dec 2015
Upgrading Python's SQLiteoriginal ↗
22 Nov 2015
Hindsight v1.5.0 released + GUI!original ↗
16 Nov 2015
Featured on Autopsy Blogoriginal ↗
10 Sept 2015
Visualizing USN Journal Activityoriginal ↗
27 May 2015
The Chrome history was cleared!  Now what? (part 1)original ↗
12 May 2015
The Chrome history was cleared! Now what? (part 0)original ↗
2 May 2015

2014

It's All About Time - Hindsight v1.4 Releasedoriginal ↗
15 Dec 2014
Chrome Transition Valuesoriginal ↗
19 Sept 2014
Hindsight v1.2.0 Adds Chrome Cookie Decryption and Loggingoriginal ↗
8 Sept 2014
Archived History files removed from Chrome v37original ↗
4 Sept 2014
Hindsight v1.1.0 Adds SQLite and JSON Outputsoriginal ↗
2 Jul 2014
Chrome Databases Reference Chart Updated to Chrome v35original ↗
27 May 2014
Python version of Hindsight Releasedoriginal ↗
23 May 2014

2013

The Evolution of Chrome Databases Reference Chartoriginal ↗
12 Nov 2013
Hindsight v0.84 Releasedoriginal ↗
14 Oct 2013
History Index files removed from Chrome v30original ↗
2 Oct 2013
Detecting Clock Changes Using Cookiesoriginal ↗
3 Sept 2013
Hindsight v0.83 Fixes Issues with Newest Chrome versions (v26+)original ↗
10 Jul 2013

2012

Hindsight Adds Parsing of Chrome Preferences fileoriginal ↗
25 Oct 2012
Announcing Hindsight: A Free Chrome Forensics Tooloriginal ↗
3 Jul 2012

2011

Deleted File Recovery using foremostoriginal ↗
6 Aug 2011
Slack Spaceoriginal ↗
26 Jul 2011
Imaging Using dcflddoriginal ↗
2 Jul 2011