ESE Extension for the Forensic Toolkit for SQLite

Expand Your ESE Database Examination Capabilities!

NEW! Our ESE Extension can now recover deleted records.

Much like SQLite, Microsoft Extensible Storage Engine (ESE) is becoming increasingly common on Windows mobile phones and desktop operating systems. ESE, also known as Jetblue or EDB DBs, is the technology that underpins these databases such as Windows search and Cortana.

ESE works in tandem with Forensic Browser in its ESE database examination, allowing investigators to use all of the querying and reporting features available within the Browser as part of your investigation.

Running the extension once installed is simple, just create a case file, do not open an SQLite database when prompted, and then run the extension from the extensions menu.

To learn more about the ESE Extension visit our support article here