{"id":13540341,"url":"https://github.com/obsidianforensics/hindsight","last_synced_at":"2025-05-14T04:07:33.853Z","repository":{"id":17276495,"uuid":"20046426","full_name":"obsidianforensics/hindsight","owner":"obsidianforensics","description":"Web browser forensics for Google Chrome/Chromium","archived":false,"fork":false,"pushed_at":"2025-04-30T19:35:47.000Z","size":172971,"stargazers_count":1176,"open_issues_count":20,"forks_count":154,"subscribers_count":65,"default_branch":"main","last_synced_at":"2025-05-12T02:20:09.641Z","etag":null,"topics":["chrome","dfir","forensics","google-chrome","hindsight"],"latest_commit_sha":null,"homepage":"https://dfir.blog/hindsight/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/obsidianforensics.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2014-05-22T03:25:06.000Z","updated_at":"2025-05-09T13:56:06.000Z","dependencies_parsed_at":"2023-01-14T00:30:26.309Z","dependency_job_id":"d8c6d1a5-0e64-4303-9190-4d41c3b97ee9","html_url":"https://github.com/obsidianforensics/hindsight","commit_stats":{"total_commits":377,"total_committers":16,"mean_commits":23.5625,"dds":0.1671087533156499,"last_synced_commit":"b5a0101fdc51eff5282e8cf71aef80984824841d"},"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/obsidianforensics%2Fhindsight","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/obsidianforensics%2Fhindsight/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/obsidianforensics%2Fhindsight/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/obsidianforensics%2Fhindsight/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/obsidianforensics","download_url":"https://codeload.github.com/obsidianforensics/hindsight/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254069214,"owners_count":22009509,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["chrome","dfir","forensics","google-chrome","hindsight"],"created_at":"2024-08-01T09:01:47.224Z","updated_at":"2025-05-14T04:07:33.824Z","avatar_url":"https://github.com/obsidianforensics.png","language":"Python","readme":"\u003cimg src=\"./pyhindsight/static/h.png\" height=\"100px\"/\u003e Hindsight\n=========\n\nInternet history forensics for Google Chrome/Chromium\n\nHindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!). Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.\n\nIt has a simple web UI - to start it, run \"hindsight_gui.py\" (or on Windows, the packaged \"hindsight_gui.exe\") and visit http://localhost:8080 in a browser:  \n\n\u003cimg src=\"documentation/interface-v2.gif\"/\u003e\n\nThe only field you are required to complete is \"Profile Path\". This is the location of the Chrome profile you want to analyze (the default profile paths for different OSes is listed at the bottom of this page). Click \"Run\" and you'll be taken to the results page in where you can save the results to a spreadsheet (or other formats). \n\n## Manual Installation\n\nTo install Hindsight (both the command line tool and the web interface), do:\n```sh\npip install pyhindsight\npip install git+https://github.com/cclgroupltd/ccl_chromium_reader.git\n```\n\nIf you'd like to use the \"View SQLite DB in Browser\" feature in the Hindsight web interface, you'll need to run another install command:\n```sh\ncurl -sSL https://raw.githubusercontent.com/obsidianforensics/hindsight/master/install-js.sh | sh\n```\n\n## Command Line\n\nThere also is command line version of Hindsight - hindsight.py or hindsight.exe. The user guide in the documentation folder covers many topics, but the info below should get you started with the command line version:\n\nExample usage:  \\\u003e C:\\\\hindsight.py -i \"C:\\Users\\Ryan\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o test_case\n\nCommand Line Options:\n\n| Option         | Description                                             |\n| -------------- | ------------------------------------------------------- |\n| -i or --input  | Path to the Chrome(ium) \"Default\" directory |\n| -o or --output | Name of the output file (without extension) |\n| -f or --format | Output format (default is XLSX, other options are SQLite and JSONL) |\n| -c or --cache  | Path to the cache directory; only needed if the directory is outside the given \"input\" directory. Mac systems are setup this way by default. |\n| -b or --browser_type | The type of browser the input files belong to. Supported options are Chrome (default) and Brave.\n| -l or --log\t | Location Hindsight should log to (will append if exists) |\n| -h or --help   | Shows these options and the default Chrome data locations |\n| -t or --timezone | Display timezone for the timestamps in XLSX output |\n\n## Default Profile Paths\n\nThe Chrome default profile folder default locations are:\n* WinXP:   \\[userdir\\]\\Local Settings\\Application Data\\Google\\Chrome\\User Data\\Default\n* Vista/7/8/10: \\[userdir\\]\\AppData\\Local\\Google\\Chrome\\User Data\\Default\n* Linux:   \\[userdir\\]/.config/google-chrome/Default\n* OS X:    \\[userdir\\]/Library/Application Support/Google/Chrome/Default\n* iOS:   \\Applications\\com.google.chrome.ios\\Library\\Application Support\\Google\\Chrome\\Default\n* Android: /userdata/data/com.android.chrome/app_chrome/Default\n* CrOS: \\home\\user\\\\\u003cGUID\\\u003e\n\n## Feature Requests\n\nPlease [file an issue](https://github.com/obsidianforensics/hindsight/issues/new/choose) if you have an idea for a new feature (or spotted something broken).\n","funding_links":[],"categories":["Tools","IR Tools Collection","\u003ca id=\"e1fc1d87056438f82268742dc2ba08f5\"\u003e\u003c/a\u003e事件响应\u0026\u0026取证\u0026\u0026内存取证\u0026\u0026数字取证","Python","Challenges","IR tools Collection","\u003ca id=\"ecb63dfb62722feb6d43a9506515b4e3\"\u003e\u003c/a\u003e新添加"],"sub_categories":["Internet Artifacts","Other Tools","\u003ca id=\"1fc5d3621bb13d878f337c8031396484\"\u003e\u003c/a\u003e取证\u0026\u0026Forensics\u0026\u0026数字取证\u0026\u0026内存取证","Browser Artifacts"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fobsidianforensics%2Fhindsight","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fobsidianforensics%2Fhindsight","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fobsidianforensics%2Fhindsight/lists"}