Researchers at CCL-Forensics have taken a significant step forward in their analysis of SQLite databases, which are extensively used by many computers, web browsers, mobile phones and SatNavs. The latest development within epilog allows investigators to reinstate these databases to a point where the deleted data becomes live once again, and therefore available for forensic analysis. It essentially restores the deleted content back into the database…This additional functionality is now being made available to forensic community – a free trial version is available at www.ccl-forensics.com/epilog.
Amongst other uses, it can recover deleted data from Safari and Chrome browsers, iPhones and iPads (including SMS, email and calendar) and Android (SMS, call logs, calendars, address book and others).
Features of epilog:
• epilog presents deleted data contained in SQLite databases
• epilog uses 3 different algorithms in order to recover and rebuild deleted records
• epilog analyses SQLite data recovered records and matches them to a table in the live database files
• epilog works on live and deleted database files, the temporary “journal files” which are generated during a database operation and across a disc image or hex dump
• epilog enables the user to save a single field to file, or batch export multiple “blob” (binary objects) fields from the recovered records for further analysis
• epilog allows the user to generate “Insert Statements” from recovered records in order to facilitate the restoration of deleted records into a live database
Many ‘off-the-shelf’ tools can be used to view the live records in the SQLite database, but it is the deleted data which Epilog extracts that could prove pivotal in an investigation.
For example, in a recent case handled by CCL-Forensics, Epilog recovered and presented nearly 5000 entries from a smartphone’s web cache, where there were only 400 live (visible) entries.
Investigators can download a trial version of Epilog for a free evaluation at www.ccl-forensics.com/epilog, where further information about the tool can also be found.
Epilog is the first in a series of digital forensic developments created by the Research and Development team at CCL-Forensics. More tools will be made available over the coming months.
For more information, please email epilog@ccl-forensics.com.
