![everything looks better in hindsight everything looks better in hindsight](https://guides.brit.co/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8yMjI3ODc4MC9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTY0OTAxMTkwMH0.ojVfz6aN-jSs9OfXRkEOMMCnccynsEDLq4OrjwKo13E/image.jpg)
Viewing SQLite Results in Hindsight's Web UI
EVERYTHING LOOKS BETTER IN HINDSIGHT CODE
I've been using a golang program called ldbdump to explore deleted records, and you can find a lot of them! Another great thing about the switch to using the CCL Forensics' code in Hindsight is that since it parses deleted records, Hindsight now can too! More to come on this in a later post. One of the things that excited me initially when I was digging into LevelDB is that the format lends itself to keeping deleted records around for a while. New Backing Database and File System columns in "Storage" tab Bonus: Deleted Records! The File System records got a few more additional columns, thanks to suggestions from Chad Tilbury, that help you see what files still exist on disk and a bit about them (size and type). Thanks to Alex's code, I was able to add a two new columns ( Sequence and State), both about the LevelDB internals I'll expand on them in a later post. Both these record types appear in the "Storage" tab. Right now, FileSystem and LocalStorage records are the only LevelDB-backed artifacts that Hindsight parses, but I'll be adding more in the coming months. I've switched Hindsight over to using ccl_chrome_indexeddb for reading LevelDB and removed the old code and dependencies, which means Hindsight should parse LevelDB records now out of the box on all platforms! In Alex's exploration of IndexedDB, he created a pure Python parser for LevelDB! This code (which he released as open source), makes reading LevelDB in Python a lot easier. IndexedDB in Chrome is complicated in its own right, but it also uses LevelDB for data storage. Then Alex Caithness from CCL Forensics came out with a couple of fantastic blog posts (and code!) exploring Chrome's IndexedDB.
![everything looks better in hindsight everything looks better in hindsight](https://allstonpudding.com/wp-content/uploads/2018/09/Shakey-Graves-5.jpg)
EVERYTHING LOOKS BETTER IN HINDSIGHT WINDOWS
This worked great on Linux systems, as LevelDB was (relatively) easy to install, but proved a challenge on Windows systems. The Python support for LevelDB hasn't been great all the Python packages required you to have LevelDB installed on the system already and they acted like a shim to it. and for years I've had difficulties parsing it. LevelDB has been used in Chrome for years. It's been a while, but a new Hindsight release is here! This new version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more! Improved LevelDB Parsing