WHY COME?

This course focusses on the analysis of SQL databases, which you can find in most modern smartphones. Both Google with their Android OS and Apple touting their own iOS store a majority of their user data within a data storage container type called SQLite.

COURSE COMPONENTS

The participants learn, amongst other things:

• How SQLite works at the byte-level
• What are the different types of SQLite data components
• What are the 5 common locations to recover SQLite data
• How to perform report data validation
• Converting and identifying virtually any date format easily
• How to recover data from .SHM, .WAL and .journal files
• How to generate reports quickly from any SQLite database to include external linked images
• Acquisition of nearly 99% of the device data you will come across in the majority of your mobile device examinations
• Performing low level analysis
• Recovery of SQLite data bases

Extras:

Students Receive a Full Version of Sanderson Forensics SQLite Forensic Toolkit
Software and a free six-month license of Andriller software.

COURSE REQUIREMENTS

• Students should bring their own laptops whenever possible.

Laptop requirements:

• Windows 7, 8 and 10
• macOS with Bootcamp Windows 7, 8 and 10
• min. 8 GB RAM, min. 100 GB Storage\

You must have admin rights or have the admin password for software installation.
NOTE: ALL Windows updates should be done prior to class.