Digital Forensics and Incident Response website
Home News SQLite Forensic Toolkit

SQLite Forensic Toolkit

Modern operating systems typically contain many sqlite databases (often in excess of 100), SQLite Forensic Toolkit provides the tools you need to investigate these databases. There are currently three tools in the toolkit.

SQLite Recovery is a forensic tool to aid in the recovery of SQLite databases, tables and records. SQLite Recovery can search a phone, disk, volume, image or file for deleted SQLite databases. The output of SQLite Recovery is individual sqlite databases that can be investigated with other forensic software such as SkypeAlyzer.

SQLite Forensic Explorer is a low level (hex) viewer for SQLite databases and WAL files. With it an investigator can see every byte used by SQLite decoded and displayed in context for each page/B-Tree/record. Sqlite Forensic Explorer can be used to recover deleted records stored in unused space in SQLite databases pages. It is an excellent instructional tool to teach an investigator "how SQLite works" at the file level.

Forensic Browser for SQLite Is a gui based graphical query designer and reporter that allows users with no SQL experience you to easily create queries on selected tables and columns and output the resultant data to a formatted PDF report. The Browser allows you to correctly view encoded dates and times as strings as well as showing blobs containing pictures (Skype and  WhatsApp are two examples) as well as output these fields correctly to a report.

More information available at the link below
http://sandersonforensics.com/forum/content.php?195-SQLite-Forensic-Toolkit

Go to news list