Complete SQLite Forensics

Online or In-Person Digital Forensic Training 

About Our SQLite Forensics Training

Our Complete SQLite Forensics Training now combines our 3-day SQLite Foundations & 2-Day Advanced SQLite training into one all-encompassing class!

Since their initial introduction in 2007, Smartphones have come to dominate the cellular phone marketplace quickly making feature phones nearly obsolete. This domination is split fairly evenly between two major companies: Google with their Android OS and Apple touting their own iOS. Even though both of these companies are business rivals and their file systems are significantly different, both share a commonality in that they both store a majority of their user data within a data storage container type called SQLite. “SQLite is an in-process library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.”[1] Mobile Forensic Analysts can easily leverage this commonality, by learning the skills required to perform low-level analysis and recovery on SQLite databases. Once learned and mastered, examiners, can then support nearly 99% of the device data they will come across in the majority of their mobile device examinations. To illustrate the vast amount of work to be done, as of January 2015, the Google Play Store reported 1.43 Million Applications being available in its Google Play Store[2]. At the same time, Apple’s iTunes Store reported over 1.4 Million apps currently being available for download. That’s a total of over 2.8 MILLION apps. Even the most popular mobile forensic tool only supports the parsing of 200 different applications. This support accounts for a minuscule %001 of the total apps and leaves a 99.999% gap!

This class will help examiners close that gap by teaching the students:

  • How SQLite works at the byte-level
  • What are the different types of SQLite data components.
  • What are the 5 common locations to recover SQLite data.
  • How to perform report data validation
  • How to Reverse Engineer ANY SQLite database
  • Converting and identifying virtually any date format easily
  • Display BLOB data within the forensic tool
  • How to use a tool designed from the ground up as a forensic tool
  • How to recover data from .SHM, .WAL and .journal files
  • How to generate reports quickly from any SQLite database to include externally linked images.

Pre-Requisites:

  • Navigating and executing programs at the Command Line (Unix or DOS) is required.
  • Beginner programming/scripting experience is helpful (but not required).

Included with Training

FREE! Students attending our SQLite Training will receive:

  • A full version of Sanderson Forensics SQLite Forensic Toolkit software ($595 USD value.)
  • USB flash drive (or in the case of online students – a link to a drive image) with SQLite Library full of useful scripts used in class, all course exercises/materials/software and hundreds of pages of SQLite documentation.

What Will I Learn?

SQLite Fundamentals

  • How SQLite works at the byte-level
  • What are the different types of SQLite data components?
  • What are the 5 common locations to recover SQLite data?
  • How to perform report data validation.
  • How to Reverse Engineer ANY SQLite database.
  • Converting and identifying virtually any date format easily.
  • Display BLOB data within the forensic tool.
  • How to use a tool designed from the ground-up as a forensic tool.
  • How to recover data from .SHM, .WAL and .journal files.
  • How to generate reports quickly from any SQLite database to include externally linked images.

Advanced SQLite Forensics

  • SQLite Record Recovery (Incomplete and Orphaned Records)
  • Manual Parsing of Write-Ahead Logs and Journal Files
  • Advanced-Data Recovery Scenarios
  • Manual SQLite Data Recovery
  • SQLite Payload Examination/SQLite Data Construct Parsing
  • Using simulations to perform data testing/verification/decryption
  • SQLite Encryption
  • Advance Scenario Exam

Laptop Minimum Requirements

We encourage students to bring their own laptops whenever possible. If this is not possible, Teel Technologies Europe will provide one for you. If you are bringing your own laptop, please indicate it on the class registration form.

Below you will find our list of laptop requirements; please ensure the following requirements are met.

For instruction on How to Turn off Driver Signature Enforcement on Windows 8.x – 10.x, follow our easy 6 Step Guide.

 

Laptop Requirements

  • Windows 7
  • Windows 8.x and 10.x
  • macOS with Bootcamp Windows 7
  • macOS with Bootcamp Windows 8.x and Win 10.x
  • macOS alone will not work (No Virtual Machines)
  • 8GB RAM (minimum)
  • 100GB storage (minimum)
  • You must have admin rights or have the admin password for software installation.
  • NOTE: ALL Windows updates should be done prior to class.