Following my talk on SQLite Forensics at the CEIC conference I want to share the scripts I wrote but did not get the opportunity to demo during the talk! I talked about using Python to export data from the Favicon database in the Chrome web browser, any SQLite database using python. In this post I’m going to link you to the scripts and a sample of the output and what they are doing.
There are two small scripts, SQLite_GetTables.py and SQLite_GetData.py. They are both primers to get you started. You will need Python27 and the sqlite3 module installed on your computer. I’m running python 2.7.5.
The first script shows you a list of the “tables” in the SQLite database you want to examine. I call this script SQLite_GetTables.py to list the table names. Once I have a list of table names I can output the data for the table I am interested in with the second script SQLite_GetData.py as you can see below. The scripts are quick and dirty but very nice for a quick look at the data!
The output
This is the code for sqlite3_GetTables.py
This is the code for sqlite3_GetData.py
Link to download the scripts: Download
Wrap-Up
I hope you found this post interesting an helpful! The scripts are quick and dirty examples to get you going with sqlite3 database in python. If you have ideas, suggestions or other scripts you would like to share please let me know by posting a comment or send me a tweet @dave873.
Happy scripting!