Hindsight

To analyze Firefox profiles, you must specify the browser type using the -b Firefox flag (or select "Firefox" in the GUI). You must point Hindsight to the profile directory (e.g., [userdir]\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>).

Hindsight parses the following files within the Firefox profile:

• places.sqlite (history visits, bookmarks, and downloads)
• cookies.sqlite
• formhistory.sqlite

Hindsight provides a simple web interface for analyzing browser profiles.

1. Start the interface by running hindsight_gui.py (or hindsight_gui.exe on Windows).
2. Open a browser and visit http://localhost:8080.
3. Enter the Profile Path (the location of the Chrome or Firefox profile you want to analyze).
4. Click Run.

Once processing is complete, you will be directed to a results page where you can save the extracted data to a spreadsheet or other formats.

To install both the command line tool and the web interface, use pip to install pyhindsight and the required ccl_chromium_reader dependency from GitHub.

If you want to use the "View SQLite DB in Browser" feature within the web interface, you must also run the provided installation script via curl.

pip install pyhindsight
pip install git+https://github.com/cclgroupltd/ccl_chromium_reader.git

# Optional: For "View SQLite DB in Browser" feature
curl -sSL https://raw.githubusercontent.com/RyanDFIR/hindsight/main/install-js.sh | sh

When a field is no longer needed, follow these procedures based on its usage status:

If the field is still being accessed

Mark the field with the [deprecated = true] option. This is necessary to maintain backwards compatibility for the browser.

If the field is no longer accessed

1. Remove the field.
2. Add reserved entries for both the name and the tag number to prevent reuse.

CRITICAL NOTE: If the data type uses Protection against data override by old Sync clients, do not remove the field even if it is no longer accessed. The field must remain in the proto definition so it can be treated as supported for the purpose of trimming, preventing data from being carried forward indefinitely.

When calling decode_user_data(user_data_key, value, timezone), the function returns a tuple in the format (label, formatted_value, event_time):

• label (str): A friendly subsystem name (e.g., used for the 'Type' column in reports).
• formatted_value (str): A human-readable string representation of the data.
• event_time (datetime.datetime | None): A timestamp extracted from the subsystem data (if available), used for the last_modified column. Returns None if no timestamp is present.

Fallback Behavior: If no specific decoder matches the key, the function returns:

• ('user data', <utf-8 string>, None) if the value is valid UTF-8.
• ('user data', '<binary len=X, first 32 bytes=0x...>', None) if the value is binary/non-UTF-8.

The command line version (hindsight.py or hindsight.exe) allows for automated analysis of browser artifacts.

Example usage:

C:\hindsight.py -i "C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default" -o test_case

Use the following flags when running hindsight.py or hindsight.exe:

When using the -i or --input flag, these are the standard locations for Chrome profiles:

• WinXP: [userdir]\Local Settings\Application Data\Google\Chrome\User Data\Default
• Vista/7/8/10: [userdir]\AppData\Local\Google\Chrome\User Data\Default
• Linux: [userdir]/.config/google-chrome/Default
• OS X: [userdir]/Library/Application Support/Google/Chrome/Default
• iOS: \Applications\com.google.chrome.ios\Library\Application Support\Google\Chrome\Default
• Android: /userdata/data/com.android.chrome/app_chrome/Default
• CrOS: \home\user\<GUID>

The decode_user_data function is used to process REG_USER_DATA: records found in the Chromium Service Worker LevelDB. It dispatches the data to a specific subsystem decoder (such as Push Messaging, Background Sync, or Notifications) based on the provided user_data_key.

If a matching subsystem decoder is found, it returns a tuple containing a subsystem label, a human-readable formatted value, and an optional event timestamp. If no decoder matches, the function falls back to a generic UTF-8 string or a hex preview of the binary data to ensure the information is not lost.

decode_user_data(user_data_key, value, timezone)

When analyzing Chrome/Chromium artifacts, DevTools "Background services" panel events are logged under user data keys starting with devtools_background_services_. These events are stored as BackgroundServiceEvent protobufs.

To decode these events, use the decode function. It parses the raw value and returns a tuple containing a human-readable service label, a string of event details (including event name, instance ID, origin, service worker registration ID, and metadata), and a timestamp.

Key Format: devtools_background_services_<service_int>_<UUID>

• <service_int>: An integer identifying the subsystem via the BackgroundService enum.
• <UUID>: A unique identifier for the event entry.