What does the Hindsight browser forensics tool do?
Hindsight is an open-source browser forensics tool that extracts and correlates many artifact types from web browsers into a unified timeline. It supports Mozilla Firefox and Chromium-based browsers, including Google Chrome, Microsoft Edge, and Brave. If you need to reconstruct what happened on a machine by examining browser activity, Hindsight is built for that task.
What Hindsight extracts
Hindsight pulls browser artifacts and correlates them rather than dumping raw files in isolation. The output is a unified timeline, which lets you line up activity across different artifact types instead of reviewing each source separately.
The tool is part of Hindsight Foundry, a site dedicated to browser forensics research, open source tools, and related resources. Hindsight Foundry is also home to Unfurl, a separate tool for URL analysis.
Supported browsers
| Browser | Support |
|---|---|
| Mozilla Firefox | Yes |
| Google Chrome | Yes (Chromium-based) |
| Microsoft Edge | Yes (Chromium-based) |
| Brave | Yes (Chromium-based) |
| Other Chromium-based browsers | Yes |
Firefox support was added as a later feature. Alongside it, Hindsight gained parsing for Service Worker-related data and additional sources for extensions and downloads.
How it fits into a DFIR workflow
Hindsight is written in Python and released as open source, so it can be run in environments where you control the tooling and can inspect the code. It is aimed at digital forensics and incident response work, where the goal is turning raw browser artifacts into answers.
A practical way to think about it: you supply browser artifacts from a system under examination, Hindsight parses and correlates them, and you get a timeline you can investigate. That timeline is the starting point for questions like what sites were visited, when, and how that activity relates to other events on the host.
Hindsight vs. Unfurl
Hindsight Foundry maintains two tools with different jobs:
- Hindsight — browser forensics. Extracts and correlates browser artifact types into a unified timeline.
- Unfurl — URL analysis. Breaks URLs into components and visualizes extracted data as a directed graph, built for DFIR and OSINT analysts who need to extract maximum intelligence from URLs.
If your question is about what a browser recorded, use Hindsight. If your question is about what a specific URL contains or reveals, use Unfurl.
Where to start
The Hindsight Foundry site hosts the tools, a blog, and training resources. Recent posts cover Unfurl parser additions (Gmail, Outlook Safe Links, Facebook, Instagram, and GitHub) and the Firefox support release for Hindsight. The site also notes hands-on browser forensics training structured around practical investigative questions, with a new course listed as launching soon.
For release notifications and occasional browser forensics write-ups, the site offers a subscribe option.