![]() And I choose to recover deleted application data. For example, this is an iTunes backup and it has that database living inside the iTunes backup. So you grab this to recover data as you are parsing. You can look at the table as it stands - now this is with active data - or you can thumb over to the SQLite database with recovered data. So let’s look at some of these options here. And then you are looking at that same database, but within the Detective tool, not with the external SQLite viewer. So I’m going to go back to Detective and I want to simply double click on that database. So now I want to show you what this looks like in the internal viewer. Now we’re looking at people saved in an address book. Creation and modification date of these contacts. We’ve got organization notes, lots of good information here. Immediately, I see some information that perhaps I want to take this out of the tool. You just need to get in here and do some validation.Ĭome inside of the database, right click for that external viewer, and then thumb through your tables here. And you want to validate that what is being parsed is true. And maybe we’re validating information, maybe we’re pulling data from a database that did not parse, or we are pulling data from - a database from - maybe an updated application. So we’ll right click on it and open SQLite viewer. So this is new, in that we can now use a query builder inside of the internal viewer, but first I’m going to show you the external one. We can open up the external viewer or we can open up the internal viewer. So I’m looking for the address book, database address,. Go ahead and use your find text box to look for that specific database that you’re looking for. So let’s first navigate into our file section, into whichever device you have extracted and pulled over and parsed with Detective, and then tab over to your databases and look for that SQLite database that you need to dig down into. This one’s going to be on our SQLite database viewer and our query builder that’s built into the tool. Welcome back to Oxygen Forensic Detective’s weekly knowledge nuggets. Amanda: Hey everyone, It’s Amanda Mahan with Oxygen Forensics’ training team. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |