What is Hindsight Foundry?
Hindsight Foundry is a website dedicated to browser forensics research, open source DFIR (digital forensics and incident response) tools, and related training. It hosts two main tools — Hindsight for browser forensics and Unfurl for URL analysis — along with a blog and an upcoming browser forensics course. It was formerly known as dfir.blog and is run by Ryan Benson.
What tools does Hindsight Foundry offer?
Hindsight — browser forensics
Hindsight extracts and correlates many artifact types from web browsers into a unified timeline. It supports:
- Mozilla Firefox
- Chromium-based browsers, including Google Chrome, Microsoft Edge, and Brave
It is open source and written in Python. Recent additions include parsing Service Worker-related data and additional sources for extensions and downloads.
Unfurl — URL analysis
Unfurl breaks URLs into their components and visualizes the extracted data as a directed graph. It is built for DFIR and OSINT analysts who need to extract maximum intelligence from URLs. It is open source.
The Unfurl v2026.09 release added parsers for Gmail, Outlook Safe Links, Facebook, Instagram, and GitHub, decodes more timestamps in tokens and IDs, and adds new Tree and Text views to the web UI.
What else is on the site?
Beyond the tools, Hindsight Foundry publishes a blog and is developing training material:
| Resource | What it covers | Status |
|---|---|---|
| Hindsight | Browser forensics across Firefox and Chromium-based browsers | Available |
| Unfurl | URL component extraction and graph visualization | Available |
| Blog | Release notes and browser forensics deep-dives | Available |
| Browser forensics training | Hands-on course for security analysts, structured around practical investigative questions | Launching soon |
Who is it for?
The tools and content target DFIR and OSINT analysts, security analysts, and anyone who needs to understand web browser artifacts. If your work involves reconstructing user activity from browser data or pulling intelligence out of URLs, both tools address that directly.
How to stay updated
The site offers a subscribe option to get notified when new Hindsight and Unfurl releases drop, along with occasional browser forensics deep-dives. The blog's "View all posts" section lists the full archive of release announcements and articles.