SQLite - dfir.blog

SQLite

A collection of 6 posts

Capturing Chrome's Evolution

Capturing Chrome's Evolution

When I was pretty fresh in the field of digital forensics, I picked this new thing called Google Chrome to dig into. There weren't a lot of tools out there that could parse it and I thought learning about browser history would be a useful skill for me.

Chrome Evolution

Show One Level Show Two Levels Show All Version: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Alexa, Tell Me Your Secrets

Open Source Tools

Alexa, Tell Me Your Secrets

The Amazon Echo is a nifty little device that you communicate with via speech - you can ask it to do various tasks and it verbally replies. You preface each command with the trigger word - either "Alexa", "Amazon", or "Echo". The Echo uses

Upgrading Python's SQLite

Open Source Tools

Upgrading Python's SQLite

SQLite and Python in DFIR SQLite databases are being used in more and more applications, and thus forensic examiners are increasingly running across them in investigations. Python seems to be one of the languages of choice for the DFIR community, and so SQLite and Python often intersect. I've

Featured on Autopsy Blog

Presentations & Interviews

Featured on Autopsy Blog

I will be speaking at the Open Source Digital Forensics Conference (OSDFCon) next month about a new tool I'm releasing. It's called SQUID, or SQLite Unknown Identifier, and it finds exact and near matches of SQLite databases based on database structure. I spoke with the folks

History Index files removed from Chrome v30

History Index files removed from Chrome v30

The new update of Chrome (v30) released yesterday has a number of security fixes, new features, and improvements, but it also unfortunately came with some bad news for forensicators: the History Index files are no more. These files were SQLite DBs named 'History Index YYYY-MM' and had the