Hindsight adds Firefox support!
Hindsight now supports Mozilla Firefox! Other new features include parsing Service Worker-related data and parsing additional sources for extensions and downloads.
dfir.blog
Digital forensics, web browsers, visualizations, & open source tools
Latest posts
Hindsight v2026.04 Released!
Hindsight v2026.04 adds parsing of Session files (including form data), platform notifications, & Google Knowledge Graph lookups for page categories and entities!
Hindsight v2026.01 Released!
Hindsight v2026.01 brings new features, including parsing Sync Data, an updated terminal interface, improved output formats, and dozens of fixes and enhancements.
Unfurl 2025.03
Unfurl v2025.03 adds new features, including parsing Google Search's UDM parameter, support for Mastodon forks (like Truth Social), and a utility parser to "clean up" inputs.
Hindsight v2025.03 Released!
Hindsight v2025.03 focuses on Extensions - parsing more activity and state records, highlighting Extension permissions, and making it easier to examine Manifests.
Unfurl v2025.02 Released
Unfurl v2025.02 adds parsing of obfuscated IP addresses, more Bluesky timestamps, and more!
Authenticating Screenshots from Netflix's Carry-On Movie
I watch Netflix's Carry-On, notice a real Google Search URL on screen, extract lots of data points from it and "authenticate" the screenshot.
Video of "What Can DFIQ Do For You?" Posted
The talk "What Can DFIQ Do For You?" that Jon Brown and I gave at the SANS DFIR Summit 2023 has been posted on YouTube!
Unfurl v2023.09 Released!
Unfurl v2023.09 adds parsing for JWTs, URLs with encoded DoH (DNS over HTTPS) requests, and more Mastodon servers.
Unfurl v2022.11: Social Media Edition
This "social media edition" Unfurl release includes parsing Twitter sharing codes, timestamps from Mastodon and LinkedIn IDs, expanding Substack redirects, & more!
More Search URL Parsing, MISP Lists, & More in Unfurl v2022.02
Unfurl v2022.02 adds parsing for Google Search's aqs parameter, integrates MISP "warninglists", adds 3x more shortlink expansions, and more!
Hindsight v2021.12
Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more!
Cookies Database Moving in Chrome 96
To support stronger security for Chrome, some network-related files - including the Cookies database - are moving locations on disk.
Metasploit URLs, Hash Lookups, & More in Unfurl v2021.06.15
A new Unfurl release is here! v2021.06.15 adds decoding of some Metasploit URLs, hash identification and API lookups, & more!
Unfurl Plugin and "Site Characteristics" Artifact Added in Hindsight
I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database ! Unfurl Plugin I'm