Today I’m posting some research I did early last year related to querying Chrome Web Browser SQLite databases which is how Chrome stores most of the useful information that makes for a great browsing experience. A byproduct of course is useful information for an examiner. In this post I’m going to talk about two databases
A new beta of SQLiteDiver has been released. The graphical and console versions are now bundled into a single zip file. Version 0.5 of SQLiteDiver is available for download. You can review changelog here. The graphical version can now open SQLite databases from the command line or Windows Explorer using “Open With” and file associations.
Slides from my SQLite Forensics talk at #CEIC2014 have been posted. If you would like to download them you can get them here.
A new build v0.4 has been posted to the Downloads section. Date conversions should be more accurate. Changelog v0.4 Rewrite of datetime decoding. Code is less brittle with better error handling. Fixed some datetime decoding logic. Dates that were showing 2011 now decode properly. (value – 11644473600000000) / increment. Added some additional date indicators for
Welcome reader, Friday I was interviewed on the Forensic Lunch about a utility I released this week called SQLiteDiver and the upcoming speech on SQLite Forensics I will be giving at the CEIC Conference. The talk will be on Tuesday, May 20th @ 8am. If you would like to hear more be sure to add my
The latest version of SQLiteDiver a SQLite database viewer has been posted. Some nice improvements have been made in this release. You can now use drag and drop to open a file. Mac timestamps now decode properly and more. Take a look at the changelog for more detail! You can get the latest, v0.3 in
A new version of SQLiteDiver has been released. It now decodes time’s stored as doubles with decimals in some sqlite databases. v0.2 added decoding for dates in double from obscure ios sqlitedb’s. GUI only: fixed issue where error popup persists until app restarted. You can download the new version in Downloads.
I’m please to announce a new tool for reviewing SQLite 3 databases called SQLiteDiver! SQLiteDiver is for mobile and browser SQLite databases that can decode datetimes that are often stored as integers and have to be decoded by hand. There are two interfaces available, a graphical viewer and a console version. The overall goal is