Skip to content

Hindsight test corpus v1

Latest

Choose a tag to compare

@RyanDFIR RyanDFIR released this 04 Sep 18:55

Browser profile corpus for Hindsight's end-to-end parse tests.

Six roots, one archive each. Extract them all into one directory, then point the
test suite at it:

HINDSIGHT_TEST_CORPUS=/path/to/corpus pytest tests/test_corpus_e2e.py

Roots, with raw size and profile count:

  • bf4sa_2025_bob-1 (982 MB, 2 Chrome profiles)
  • bf4sa_2026_bob-2 (1701 MB, 2 Chrome profiles)
  • magnet.ctf_2018 (673 MB, 2 Chrome and 2 Firefox profiles)
  • magnet.ctf_2019 (376 MB, 2 Chrome profiles)
  • magnet.ctf_2020 (577 MB, 1 Chrome profile)
  • magnet.ctf_2023 (1638 MB, 4 Chrome and 1 Edge profile)

That is 16 profiles and 218,149 parsed records in total, covering Chrome from
2018 to 2026 plus Firefox and Edge.

The bf4sa roots are a synthetic persona created for training material. The
magnet roots are Magnet Forensics CTF images. Saved passwords and cookie values
in these profiles are DPAPI-encrypted and bound to the machine that created
them, so they cannot be read from these archives.

SHA256SUMS lists the checksums.