Modern operating systems typically contain many sqlite databases (often in excess of 100), SQLite Recovery can be used to display all of them alongside each other allowing the investigator to gain an overview of the type and content of all of the databases on the suspects computer.
Import downloaded pictures saved with Blackberry messenger on IOS
View the content of the Google Chrome Cache files
Decode the usernames and IP addresses from Skype ChatSync files
Modern operating systems typically contain many sqlite databases (often in excess of 100), SQLite Recovery can be used to display all of them alongside each other allowing the investigator to gain an overview of the type and content of all of the databases on the suspects computer. These databases can contain anything from SMS messages to lists of passwords and are an invaluable source of evidence.
SQLite Recovery is a forensic tool to aid in the recovery of SQLite databases, tables and records. SQLite Recovery can search a disk, volume, image or file for deleted SQLite databases.
The output of SQLite Recovery is individual sqlite databases that can be investigated with other forensic software such as SkypeAlyzer.
SQlite Recovery can now keyword search on multiple keywords across ALL carved sqlite tables simultaneously irrespective of the table schema.
Simple to use
Carves deleted journal and WAL files
Distinguish between live and deleted records in a database
Carves unknown databases (including those in unallocated space)
Search all tables for multiple keywords at one
Template constraints can override column affinity
Extracts to sqlite databases to investigate with ‘other’ forensic software
Extract every bob from every database to view in another forensic tool
Export a recovered table to XLS
Parse time filtering to improve quality of recovered data
Optionally display numeric columns as formatted date
Advanced filters to clean up data post parse
Automatically identify and delete duplicate rows
Supports parsing from individual files (DD/Unallocated), logical and physical devices, EWF images.
Basic Operation of SQLite Recovery
SQLite Recovery searches multiple carved databases irrespective of the table schemas:
SQLite Forensic Explorer
SQLite Forensic Explorer is an investigative tool designed to show every single byte of an SQLite database or WAL file along with its decoded data. This means you can look at any field in the DB/WAL file header and see what it means, or you can look at an index B-Tree page and see each structure within the page decoded.
SQLite Forensic Explorer provides an unparalleled view into the structure and workings of SQLite at a file level and is invaluable to forensic investigators looking for deleted data (or a corrupt database) or to those who simply want to know more about the structure of a database
Supports SQLite databases and WAL and Journal files
Can display tables and rows from corrupt databases
Decodes every SQLite structure
Follow an SQLite table or index B-Tree from the root to its leafs
Recover deleted data from unused space
Follow the reverse pointer tree
View the freelist and every page within it
Highlight and examine unused spaces in tables and indexes for deleted data
Automatically decode deleted data in the hex view and display as a record
See how each record is encoded and stored in a table or index
In the display below the unused space in this interior table (actually a root B-Tree page) is highligted in the hex view in grey. The highlighted byte at offset 106 is the start of the payload data for this SQLite record, SQLite Forensic Explorer has identified this as from the Skype messages table and has displayed the decoded row in table form, as below: