SQLITE FORENSIC REPORTER - ANALYST REVIEW PROCESS

Reviewing all SQLite database files case wide can be a time consuming process, the following stages in combination with SQLite Forensic Reporter streamlines both pre-processing and analysis processes.

Identify & Gather All Databases Casewide all SQLite database files are identified within the entire scope of the case and exported for processing by SQLite Forensic Reporter.

Batch Extract all Tables from SQLite Database all identified SQLite database files are opened and data is extracted into TXT, CSV and HTML formatted reports.

Review Unidentified Databases all SQLite database files not identified by a template should be reviewed manually, identifying purpose of tables and columns contained within.

Create New Template for Unidentified Databases a new template is created containing selected fields, correctly decoded and where appropriate tables linked. To reduce the manual analysis of SQlite databases templates should be shared and distributed amongst users.

After the identification and decoding of SQLite databases has been conducted the extracted data needs to be reviewed to identify what data has been extracted and if the decoding process is accurate. To facilitate this SQLite forensic reporter templates need to be as upto date as possible to maximise the automated identification, decoding and presentation of the contents of SQLite databases casewide.