Enhance your toolkit with clearer, more precise forensic analysis. Designed to complement your trusted platforms, our solutions help you work sharper and with greater precision.
Learn how to master comprehensive digital forensics workflows through immersive, hands-on training. Confidently apply your skills in real investigations.
Targeted micro-learning modules to help you rapidly address critical challenges, strengthen expertise, and stay fully up to date.
Instantly decode variable-length integers from SQLite databases, protobuf messages, and app data structures. This utility converts hex values to decimal in seconds, perfect for analyzing WhatsApp databases, custom app formats, and messaging data without requiring custom scripts.
ED SQLite Visualizer transforms how you analyze mobile databases. Trace deleted records frame by frame. Map complex schema relationships visually. Recover evidence from WAL files and unallocated space through an intuitive interface designed for modern investigations.
Transform iOS backup data into organized, navigable file structures. This free Windows tool extracts and normalizes iTunes backup content, complete with hash verification and device metadata. Access your backup data through a clear, logical file system ready for efficient analysis and reporting.
Learn to extract deleted or uncommitted data from WAL and SHM, reconstruct timelines, and uncover hidden app activity your tools can’t show.
Learn to manually decode pages, recover deleted records, and confidently validate your findings, perfect when you need precise, court-ready evidence.
Start strong with the essentials. Learn how to collect, examine, and explain digital evidence. From data acquisition to reporting, build practical skills through real cases and guided labs. Built for those starting out or refreshing the basics.
Become an expert in mobile forensics, from acquisition to reporting. Built for real cases, updated for today’s Android and iOS challenges. Gain skills that go beyond tool output.
Explore SQLite databases in depth, the hidden layer beneath mobile apps and operating systems. Learn how to extract, decode, and interpret data to uncover user activity and forensic artifacts.
Dig deep into unsupported apps with hands-on SQLite analysis. Use Python to script, automate, and extract what tools miss. Gain a technical edge for advanced mobile forensics.
Learn when it works for you. 24/7 access to real-case modules. Pause, replay, and apply at your own pace.
Join live sessions from anywhere. Ask questions, try out techniques, and learn by doing. All the energy of the classroom, without the commute.
Learn in person from expert forensic practitioners through hands-on labs designed to build deep, practical skills.
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
This guide provides a practical walkthrough for forensic analysts dealing with encrypted Apple Notes in iOS 16.x. It focuses on identifying and decrypting locked notes stored in the NoteStore.sqlite database extracted from iOS backups.
After decades of solving cases, testifying in court, and training forensic teams around the world, James Eichbaum founded Elusive Data in early 2024.
Well known in the digital forensics community from his former roles as an investigator, Global Training Manager, and instructor for some of the leading names in the industry, James started the company with a clear idea: training should be more hands-on, immersive, and reflect the real challenges of daily investigations. It should also be more accessible, giving investigators faster access to the knowledge they need to act quickly, make sense of complex data, and solve cases without delay.
Today, Elusive Data helps professionals around the world learn through immersive, hands-on training. Courses include interactive labs, CTF challenges, and practical exercises built around real case data. Training is available on-demand, live online, and on-site.
Along the way, it became clear that some of the biggest challenges investigators face are more than just knowledge.
Gaps between what tools show and what investigators need to understand kept slowing work down.
That’s why Elusive Data also develops focused forensic tools: practical utilities built directly from training, casework, and day-to-day investigative needs — designed to remove friction, provide clarity, and support defensible analysis.
Elusive Data also supports active investigations through expert consulting and forensic services, for a field that never stands still.
Get help uncovering and explaining digital evidence. We deliver clear, reliable results for investigations, legal cases, and internal reviews.
Build stronger forensic capabilities with expert guidance. From setting up labs to improving workflows. We help you work smarter, faster.
Making digital forensics training more accessible Elusive Data was founded in early 2024 with a clear purpose: to make advanced digital forensics training more accessible,
PRESS RELEASE Stockholm, Sweden – December 9, 2025 Elusive Data has officially released SQLiteVisualizer™, a next-generation forensicplatform that gives investigators unprecedented insight into how mobile
Small time-savers can make a big difference in mobile forensics.
That’s why VarInt Calculator is now available as a dedicated iOS app—bringing fast VarInt decoding and clear SQLite insights straight to your iPhone or iPad.
Something new is coming to mobile forensics At Elusive Data, our mission has always been clear: to help forensic professionals work faster, more accurately, and
New course out now: Gain control over app data like never before. Learn to uncover, validate, and defend hidden evidence — no waiting, no travel.
Instantly decode VarInts from mobile app databases with Elusive Data’s free forensic tool. Convert hex, binary, and decimal values for faster, more accurate investigations.
Discover Backup2FS, a free tool from Elusive Data that simplifies iOS backup analysis by normalizing backups into an easy-to-navigate file system.
Discover how I decrypted a locked Apple Note from an iOS 16.7.10 device using open-source tools like Hashcat, Python, and CyberChef. This step-by-step forensic workflow reveals the process behind extracting and decrypting hidden content from Apple’s Notes app. A must-read for digital investigators and mobile forensics professionals.
SQLite overflow pages store fragmented data that doesn’t fit within a single database page, requiring forensic analysts to reconstruct them for complete evidence recovery.
