)
SQLite Forensic Analysis
June 1-2 (Pre-Conference)
If you think of database formats encountered during an examination, SQLite databases are most likely top of your list. From mobile devices to standard desktops there are thousands of applications that utilize SQLite to store data. At Spyder Forensics we recognize the importance that SQLite database forensics plays in the potential recovery of data that can provide the key actionable intelligence needed for a case.
The question now becomes, are you examining all the data stored in the SQLite Data Files?
This two-day intermediate forensic course gives examiners a deeper understanding of how SQLite works under the hood. On Day 1 we start by deep diving into the main database file, looking at b-tree pages, freelist pages, and overflow pages. Participants will gain an understanding of the page structures and the potential for recovering records from page unallocated space, freeblocks, and freelist pages.
The main focus of Day 2 is the SQLite Journal files and how they can play a key role in uncovering past states of the database. With an understanding of how the Journals files work, participants can exploit the journal files design to potentially recover deleted records including scenarios where secure_delete is in play.
By the end of the course, participants will have a firm grasp of the inner workings of SQLite databases and will have the knowledge they need to competently deal with this popular database format.
