SQLite – Recovering deleted and partial records

In this article I want to discuss how we can recover deleted records from an SQLite database, or rather how we can recover all records and distinguish between those that are live in the DB and those that are found… Read more

Dealing With Records Found in SQLite Rollback Journals

Sanderson Forensics was recently contacted by a customer at a police force with a question relating to deleted SQLite records that were found in a rollback journal. The requirement was to create a report(s) showing both the live records in… Read more

Reconnoitre – Link files, geolocation and C4P

Since Reconnoitre was released in January this year there have been a number of enhancements driven by requests from our users including link file support, EXIF and geolocation support, features to query C4P hash servers and advanced reporting. Of course… Read more

Reconnoitre from Sanderson Forensics updated

Sanderson Forensics are pleased to announce an update to our most recent software tool Reconnoitre. Reconnoitre allows the forensic investigator to quickly and easily investigate images containing volume shadow copies, without the need to run VSSAdmin. This latest version adds… Read more

Reconnoitre Released by Sanderson Forensics

Sanderson Forensics are pleased to announce the release of Reconnoitre. Reconnoitre is a forensic application designed to make working with files within a Volume Shadow Copy as easy as working with a file in any image. Simply: 1. Create a… Read more