SQL DB forensics PATCtech CTO Glenn K Bard

SQL / DB forensics PATCtech – CTO Glenn K. Bard CISSP, En. CE, AME, CHFI, A+, Network+, Security+

SQL / DB forensics • Why is it so important to learn SQL / DB forensics? Both i. OS and Android are heavily using database files to store contents Average smartphone will have hundreds of these files Each App will have its own set of DB, they are not shared And since each App has them, if your forensic tool does not support that App, then you will need to find another way to get the data • Contain a large amount of data, including deleted information • Can contain other files, such as jpg, plist, and so on • •

SQL / DB forensics • Before we begin, some definitions we need to know: • Tables – These are the different types of data the DB sill store. IE: messages, Handle, MSG Pieces, etc. • ROWID (ID) – This is a sequential number for an entry in the DB • SQLite Sequence – The last assigned ROWID for each table • BLOB – Binary Large Object • Unix time – Number of seconds since January 1, 1970 00: 00 • Mac time – Number of second since January 1, 2001 00: 00

SQL / DB forensics • Where will you find these files? • Each App will have its own, or in many cases, several of them. • Some good hints: • Android: Data / App name / Databases • i. OS: Private / VAR / Mobile • Applications for third party Apps • Library for i. OS installed Apps • Let’s take a look:

Android

i. OS

SQL / DB forensics • Now that we know where to locate the files, how do we do it? • First, the tools: • • Mozilla Firefox with SQLite Manager SQLite Database Browser Portable Dcode from Digital Detective Oxygen with SQLite Viewer