Hindsight

Read more on the new features at https://dfir.blog/hindsight-parses-sessions-and-notifications/

What's Changed

🚀 Features

• Add support for Knowledge Graph entity resolution and categories by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/255
• Add parsing of platform notifications (using ccl_chromium_reader). Ad… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/259
• Add Chrome session analysis, session reconstruction, and XLSX enhancements by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/264

🛠️ Minor Changes & Fixes

• Fix a bug in OPFS processing logic that would only show either t or… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/246
• Add parsing of additional Chrome cookie fields (top_frame_site_key … by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/247
• Add support for parsing opener_visit field in Chrome history data a… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/248
• Add (experimental) support for new cache types (DawnCache, DawnWebGPUCache, DawnGraphiteCache) by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/251
• Update some row types and XLSX coloring to better reflect their function by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/253
• Enhance Chrome IndexedDB processing for Blobs by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/258
• Refactor SQLite query execution to use a reusable context manager, im… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/265
• Add an explicit "Source Item" column showing where the row was sourced from. by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/267
• Small formatting updates to XLSX output (Sessions tab and page headers) by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/268

Other Changes

• Add Unicode support check for banner and fallback for non-Unicode con… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/252
• Up max version to 145; slight color tweaking. by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/254
• Potential fix for code scanning alert no. 1: Workflow does not contain permissions by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/256
• Bump rollup from 4.35.0 to 4.59.0 by @dependabot[bot] in https://github.com/RyanDFIR/hindsight/pull/257
• Bump vite from 6.4.1 to 6.4.2 by @dependabot[bot] in https://github.com/RyanDFIR/hindsight/pull/262
• Bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in https://github.com/RyanDFIR/hindsight/pull/261
• Replace pytz with zoneinfo for timezone handling and update depen… by @RyanDFIR in https://github.com/RyanDFIR/hindsight/pull/266

Full Changelog: https://github.com/RyanDFIR/hindsight/compare/v2026.01...v2026.04