Sqlite Forensics with SQLite Forensic Reporter - Process SQLite Databases

SQLite Forensics is the process of examining sqlite database files ( .sqlite .sqlite3 .sqlitedb .db .db3 file extension ) related to legal proceedings (civil or criminal). SQLite Forensics involves identifying, collecting, processing and reporting on the contents of each SQLite database file relevant to a case.

The SQLite database format is portable requiring little dependency of external libraries and can be found on computer systems including Adobe, Avast, DivX, Google, iPhone Backups, Mobile Phone Backups, iTunes, Mozilla Firefox. On mobile devices virtually any app on an Android, iPhone or other smart phone can use a sqlite database to store information that could be meaningful to a case.

The SQLite database is also versatile. Almost any data type can be stored within a database from a simple sentence to encrypted data. Furthermore the complexity of the content can range from a sqlite database containing a single table to dozens of tables, each table containing information that is potentially relevant.

Identification

SQLite Forensic Reporter will identify databases case wide using a combination of simple and advanced identification techniques as well as user based templates specific to a group or individual types of sqlite database (for example only iTunes backups).

Collection

SQLite Forensic Reporter will produce a report detailing what has been identified for preservation and collection.

Processing

SQLite Forensic Reporter will if required by the user batch process and extract the contents of each database identified, performing both standard and custom extractions of SQLite databases regardless of content.

Reporting

SQLite Forensic Reporter will create a report that both the end user and analyst can use. The reporting is very flexible and fully customisable to suit both the individual or large organisation.