obsidianforensics / hindsight

Web browser forensics for Google Chrome/Chromium
https://dfir.blog/hindsight/
Apache License 2.0
1.08k stars 141 forks source link

Errors while running hindsight against MacOS artifacts #152

Closed dfirhoze closed 1 year ago

dfirhoze commented 1 year ago

Describe the problem Getting the below error while running Chrome data through KAPE as well as the standalone Hindsight tool.

Screenshots or Console Output image

Expected behavior Parse the chrome artifacts and output the xlsx results file.

hindsight.log Snippet If possible, attaching the (sanitized if necessary) hindsight.log file output covering the problem run is very helpful for debugging.

System Details

obsidianforensics commented 1 year ago

Thanks for the report. From the output, it looks like Hindsight throws an exception when the file (History in your case) isn't actually a database; perhaps the collection was corrupted somehow.

I was able to reproduce with a dummy, non-database History file. I'll work on a fix for the exception, so the rest of the processing can continue.