Don't let missed app evidence determine the outcome

Yes. The training has been fully updated to match the current forensic landscape. That includes support for modern iOS and Android environments, new app structures, updated CTF scenarios, and deep dives into advanced topics like SQLite freelist recovery and manual decoding of WAL/SHM files.

Our tools are built around real forensic workflows and the questions examiners need to answer after extraction. They complement the platforms you already use, helping you work with the underlying data when you need more context, deeper analysis or an independent way to verify a finding.

Firefly brings SQLite, RealmDB, LevelDB, IndexedDB and Apple Biome / SEGB into one forensic workspace for recovery, interpretation, validation and reporting, with a clear path back to the source.

SQLite Visualizer was our dedicated SQLite analysis and recovery tool. Its workflows and capabilities now form part of Firefly, extending the same approach into a broader app data forensic workspace.

VarInt Calculator provides fast, script-free analysis of SQLite variable-length integers, serial type codes, payload sizes and overflow pages.

Backup2FS transforms iOS backups into structured, navigable file systems while preserving hashes, metadata and device information.

The common principle is simple: make the data easier to investigate without hiding how the result was reached.

We first built SQLite Visualizer because we needed a clearer way to investigate SQLite in real cases. The same questions kept coming back: what was deleted, when did it change, where did this record come from, and how can I explain it in a report?

SQLite Visualizer filled that gap for SQLite. It shows deleted records frame by frame, maps schema relationships visually, and recovers data from WAL, freelists and unallocated space. Built from casework and refined in hands-on labs, it makes database analysis faster, clearer and easier to explain.

Firefly takes that same idea further. SQLite is still central, but modern app evidence lives across RealmDB, LevelDB, IndexedDB, Apple Biome / SEGB, BLOBs, timestamps, sidecars and nested structures. Firefly brings that work into one forensic workspace after extraction, so examiners can recover what remains, interpret it in context, validate it against the source and report findings with a clear path back.

From August 31, SQLite Visualizer becomes part of Elusive Data Firefly.

Our approach is built around a simple forensic principle: a decoded value is only useful if you can understand how it was derived and trace it back to the underlying data.

Firefly keeps that source context visible throughout the investigation. Examiners can move between interpreted data, database structures and raw bytes, recover historical or deleted records, and review how a finding was surfaced before carrying that context into the report.

Key capabilities include:

Source traceability
Follow findings back to the underlying file, page and byte offset where applicable.

Integrated structure and hex analysis
Move between records, database structures and raw bytes without breaking the investigative context.

Deleted and historical data recovery
Examine what remains in SQLite WAL, rollback journals and freelists, as well as supported recovery workflows across RealmDB, LevelDB and IndexedDB.

Evidence integrity
Work with read-only evidence handling, evidence-set validation and file hashing as part of the forensic workflow.

Reporting with context
Preserve interpreted values, queries, timestamps, selected records and supporting context in interactive reports.

The result is a workflow designed to make important app data findings easier to verify, review and explain.

You can choose the format that fits your goals and schedule:

• Micro-Courses: Short, focused live sessions (60–90 minutes) on specific topics like GPT, SQLite, and encrypted apps — ideal for fast, practical learning.

• On-Demand Courses: Access certified, self-paced training 24/7. Replay labs, follow guided exercises, and apply techniques at your own speed.

• Live Online Courses: Join expert-led classes in real time. Participate in case discussions, ask questions, and complete labs with instructor feedback.

• Classroom Training: Learn face-to-face through immersive sessions and hands-on labs led by experienced digital forensics professionals.

Yes. All full-length courses include a verified certificate of completion and CPE credits, recognized by many professional bodies.

Our training supports all experience levels. You can start with foundational skills like acquisition and validation, or deepen your expertise with advanced techniques such as parsing app databases and scripting with Python for forensic automation.

No. The tools are built to make complex forensic work easier to follow, verify and explain. Whether you are decoding VarInts, navigating an iOS backup or investigating database internals, the goal is to make the process clearer and faster without hiding the underlying evidence.

When you purchase SQLite Visualizer today, a one-hour onboarding session is included to help you get started. After August 31, the same applies to Firefly.

If you need more training, just contact us. We also offer advanced SQLite forensics training, including a certified course where the tools are used as part of the practical workflow.