Using FTK forensic software to detect SQLite Database Files

The forensic software tool FTK can be used to good effect for identifying and extracting SQLite database files from a case for further processing using SQLite Forensic Reporter.

Once a case is processed in FTK navigate to Databases under File Category. In the file listing window sort by File Type. Any identified SQLite database files will be listed under SQLite Database. The files can then be selected and exported from the case.

Once the SQLite database files are copied from the forensic tool kit they can be processed using SQLite Forensic Reporter.