Sqlite Forensic Explorer Download
Dalene Huizenga
SQLite Forensic Explorer provides an unparalleled view into the structure and workings of SQLite at a file-level and is invaluable to forensic investigators looking for deleted data (or a corrupt database) or to those who simply want to know more about the structure of a databaseFeatures:
- Supports SQLite databases and WAL and Journal files
- Can display tables and rows from corrupt databases
- Decodes every SQLite structure
- Follow an SQLite table or index B-Tree from the root to its leafs
- Recover deleted data from unused space
- Follow the reverse pointer tree
- View the free list and every page within it
- Highlight and examine unused spaces in tables and indexes for deleted data
- Automatically decode deleted data in the hex view and display as a record
- See how each record is encoded and stored in a table or index
Some of this software has been further enhanced and released as commercial forensic software with thousands of licences sold worldwide. Please Note: The Sanderson Forensics suite of tools has been designed to retrieve and process small to medium datasets that are normally found on devices such as cellphones, computers, and other IoT devices, and are not intended for large-scale databases.
Sanderson Forensics provides the SQLite forensics community with a host of resources to help them in their database analysis and investigation. Scroll through our support articles, community forum threads, or join the Google Group to find the answers to commonly asked questions, help with troubleshooting, and much more.
Customizable Interface: The forensic explorer interface has been designed for flexibility. Simply drag, drop and detach windows for a customized workspace. Save and load your own workspace configurations to suit investigative needs.
Mac in simple words is a graphical user interface based Operating system. If we see the comparison graph use of Mac OS is less than the Android but still many time forensics expert encounter with the cases involving Mac as Operating system, so Mac Sqlite forensics is an important aspect. The forensics browser can be used to perform MAC database files forensics. Read More
You might have realised the browser stores a lot of sensitive information about the user and its surfing habit. Thus they play a very important role in forensics due to the nature and amount of data they store with them.
With the help of Browser Forensics and with the assistance of forensics tools one can extract sensitive data and chosen keywords from most web browsers. One can retrieve deleted data and keywords, check whether history was cleared, retrieve artifacts like Cookies, Downloads data, History, Saved Password, websites visited etc. Also, Browser Forensics helps a lot to understand how an attack on a system was conducted, helping in finding the source of Malwares/Adwares/Spywares, Malicious Emails and Phishing Websites etc.
There are many web browsers available like Chrome, Firefox, Safari, IE, Opera etc. depending upon the platform being used. In this post, we will be learning about how to conduct forensics for Google Chrome Browser.
So I opened the sqlite.db file using a hex (note HEX) editor and searched for the same text. It was found in multiple spots and with the HEX editor, and as I can see text strings, I was able to actually see the text for which I was looking.
The database indexing helps to retrieve data quickly from large databases. Indexing of database is carried out by sqlite forensics tool to manage databases files efficiently. So file size does not limits the tools capability.
The sqlite forensics tool helps to recover and view the deleted records from the database. Even secured data can be previewed. This helps to reveal digital evidences beyond the suspicious activities of the suspects.
Sqlite forensics tool helped me to recover multiple Sqlite files in one go there by managing time efficiently. Also helped me in analyzing the contents of multiple Sqlite databases in parallel throughout my investigation process. The tool did a great job for me. Thanks!"
df19127ead