Options

/c this option is required to enable SQLite FR to work from the command line.

/norecurse disable recurse sub-folders during the identification process (by default this is enabled).

/nopasswords disable auto identification of username and password fields (by default this is enabled).

/collatedt save all date/time fields into a single text file (by default this is disabled).

/labelempty add a note to the filename where any tables are found to contain no data, this is to speed up end user review time.

/unattended once identification is completed the processing and extraction starts automatically.

/md5 md5 hashes of all processed files are performed.

/nodefaultdump the default dump of all sqlite database files is disabled (only files identified against a template will be exported during processing).

/templates <folder> alternate path containing an alternate set of templates will be used during processing, these can be templates that have been developed in-house or are currently in the process of being developed.

Examples

From the Windows Command Prompt (cmd.exe), some examples:

sqlreport /c "c:\input folder\" "d:\output folder\"

The above example will search the folder "input folder" and save output to "d:\output folder". Note that file paths need to be enclosed in quotes. When this command is run SQLite Forensic Reporter will start, any sqlite database files identified in the input folder will be listed for review.

sqlreport /c "c:\input folder\" "d:\output folder\" /norecurse

The above example will search the folder "input folder" and save output to "output folder". Folders will not be recursed within the input folder.

sqlreport /c "c:\input folder\" "d:\output folder\" /norecurse /nopasswords

The above example will search the folder "input folder" and save output to "output folder". Folders will not be recursed within the input folder. A separate search for usernames and password will not be performed.

sqlreport /c "c:\input folder\" d:\output folder\" /nodefaultdump

The above example will search the folder "input folder" and save output to "output folder". The default dump of all identified SQLite databases will be disabled.

sqlreport /c "c:\input folder\" "d:\output folder\" /templates "c:\phone templates\"

The above example will search the folder "input folder" and save output to "output folder". SQLite FR templates present within the "phone templates" will be used during the identification process.

sqlreport /c "c:\input folder\" "d:\output folder\" /md5 /unattended /templates "c:\personal templates\"

The above example will search the folder "input folder" and save output to "output folder". SQLite FR will identify all sqlite database files, perform md5 hash of each identified file and commence extraction of SQLite database files to the "output folder". Only templates present in the "personal folder" will be used for template comparison.