Skip to content
Get packs

Browser Forensics with Hindsight

Reconstructs a Chromium browser's history, downloads, cookies and more into a timeline for investigators.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When installed, the agent knows how to read the database files that Chrome, Edge, Brave, Opera and Vivaldi store on disk and combine them into one chronological timeline of a user's web activity, covering visited sites, downloads, cookies, cached content, autofill and extensions. It guides the use of the open-source Hindsight tool and includes its own small Python scripts that query the SQLite history and download tables and write JSON output. It is aimed at incident responders and forensic analysts working on copies of browser profiles.

Great for

  • Incident responders reconstructing what a user did in a browser on a forensic image
  • Insider-threat or criminal investigators who need a structured browsing timeline
  • Security analysts who want a starting template for parsing Chromium profile databases

Skip it if

  • Casual users trying to recover their own browsing history, since it is built for forensic evidence handling and lacks guidance on that use
  • Work on live, unlocked production machines without proper evidence handling, because the procedures assume copied profile directories and can expose sensitive personal data
  • Decrypting saved passwords or OS-protected data: the skill notes these fields are encrypted and does not provide a way around OS-level encryption

Try asking

  • “Use Hindsight to build a timeline of Chrome browsing history and downloads from this copied User Data\Default folder”
  • “Parse the Edge profile from this forensic image and export the results to XLSX”
  • “Write a Python script that lists visits and downloads from a Chromium History database as JSON”
  • “Summarise which external sites and downloaded files appear around the date of this incident”
Step-by-step guide: how to use Browser Forensics with HindsightInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-browser-forensics-with-hindsight.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-browser-forensics-with-hindsight.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-browser-forensics-with-hindsight.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work only on copies of profile folders so original evidence is not modified; the scripts open databases read-only but copies remain safest.
  • Check the scripts before running them, since they hard-code some paths and the agent.py file searches common browser profile locations under the home directory.
  • Expect encrypted fields such as saved passwords and some cookie values to appear unreadable unless the original OS user context is available.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.