SQLite Forensic ExplorerPart of the Forensic Toolkit for SQLite
Explore Every Byte
SQLite Forensic Explorer is an investigative tool designed to show every single byte of an SQLite database or WAL file along with its decoded data. This means you can look at any field in the DB/WAL file header and see what it means, or you can look at an index B-Tree page and see each structure within the page decoded.
SQLite Forensic Explorer provides an unparalleled view into the structure and workings of SQLite at a file-level and is invaluable to forensic investigators looking for deleted data (or a corrupt database) or to those who simply want to know more about the structure of a database
- Supports SQLite databases and WAL and Journal files
- Can display tables and rows from corrupt databases
- Decodes every SQLite structure
- Follow an SQLite table or index B-Tree from the root to its leafs
- Recover deleted data from unused space
- Follow the reverse pointer tree
- View the free list and every page within it
- Highlight and examine unused spaces in tables and indexes for deleted data
- Automatically decode deleted data in the hex view and display as a record
- See how each record is encoded and stored in a table or index
In the display below the unused space in this interior table (actually a root B-Tree page) is highlighted in the hex view in grey. The highlighted byte at offset 106 is the start of the payload data for this SQLite record, SQLite Forensic Explorer has identified this as from the Skype messages table and has displayed the decoded row in table form.
Learn more about the powerful tools included in our Forensic Toolkit for SQLite
Forensic Browser for SQLite
Part of the Forensic Toolkit for SQLite
SQLite Forensic Recovery
Part of the Forensic Toolkit for SQlite
Forensic Toolkit for SQLite
To request your quote!