SQLite Forensic Explorer

Part of the Forensic Toolkit for SQLite

Explore Every Byte

SQLite Forensic Explorer is an investigative tool designed to show every single byte of an SQLite database or WAL file along with its decoded data. This means you can look at any field in the DB/WAL file header and see what it means, or you can look at an index B-Tree page and see each structure within the page decoded.

SQLite Forensic Explorer provides an unparalleled view into the structure and workings of SQLite at a file-level and is invaluable to forensic investigators looking for deleted data (or a corrupt database) or to those who simply want to know more about the structure of a database

Features:

Supports SQLite databases and WAL and Journal files
Can display tables and rows from corrupt databases
Decodes every SQLite structure
Follow an SQLite table or index B-Tree from the root to its leafs
Recover deleted data from unused space
Follow the reverse pointer tree
View the free list and every page within it
Highlight and examine unused spaces in tables and indexes for deleted data
Automatically decode deleted data in the hex view and display as a record
See how each record is encoded and stored in a table or index

In the display below the unused space in this interior table (actually a root B-Tree page) is highlighted in the hex view in grey. The highlighted byte at offset 106 is the start of the payload data for this SQLite record, SQLite Forensic Explorer has identified this as from the Skype messages table and has displayed the decoded row in table form.

Learn more about the powerful tools included in our Forensic Toolkit for SQLite

Learn more about the

Forensic Browser for SQLite

Part of the Forensic Toolkit for SQLite

Learn more about

SQLite Forensic Recovery

Part of the Forensic Toolkit for SQlite

Go back to

Forensic Toolkit for SQLite

To request your quote!